Local Vigilance, Global Defense — Leveraging Resolver at Raytheon

Quick Stats

68,000 employees
200 users
Aerospace Industry
Waltham, MA Headquarters

Applications Used

  • Incident Management

Raytheon Company has been a powerful force in technology from the beginning. Founded in 1922 as the American Appliance Company, it helped bring radios into the home, connecting people with the world. Over time, it became an innovator of defense and aerospace electronics, making important leaps forward in radar and missile systems. Raytheon developed the remarkable Apollo Guidance Computer used in the first moon landing and the first defensive missiles used to intercept hostile missiles midflight.

One of the world’s largest defense contractors, Raytheon has 68,000 employees worldwide, spread across five businesses: Global Headquarters; Integrated Defense Systems; Intelligence, Information and Services; Raytheon Missile Systems; and Space and Airborne Systems.

These businesses handle extremely important and confidential information and products, and Raytheon’s customers require high levels of security compliance. Although the businesses vary in their particular security needs, they all have one thing in common: a need to track and analyze incidents. To manage its complex security landscape, Raytheon turned to us.

The Goal

Enterprise-Wide Data Collection for Enterprise-Wide Security

Raytheon’s customers contractually require incident tracking and reporting, and the company must comply with both the standards of the National Industrial Security Program Operating Manual (NISPOM) and Underwriters Laboratories 2050 (which specifies requirements for sensitive compartmented information facilities (SCIFs), including response times to breaches). To demonstrate compliance with NISPOM and UL 2050, it is necessary to track incidents, response times, and other details.

In addition, Raytheon itself has a culture of carefully planned, strictly maintained security procedures. “We track everything,” says Adam Harting, Security System Data Analyst for Raytheon Company, “from somebody getting a traffic citation in our facilities to an alarm or potentially compromised data.” The company’s security motto—“local vigilance, global defense”— guides the security mission for all assets, physical and cyber.

Although the various businesses ere collecting security incident data, the data collection efforts were not unified. As a result, the company could not combine the data for advanced trending and other analysis.

As an advanced, high-security enterprise, Raytheon wanted to harness the benefits of enterprise-wide data collection for enterprise-wide security. What it needed was an enterprise-wide Incident Management system. 

How does such a system work? Why should it be enterprise-wide? Harting explains:

“With the ability to track incidents throughout Raytheon, at all our locations, we can more quickly detect threat trends and implement countermeasures. Suppose an incident occurs at an east coast facility, and then we note a similar incident at a west coast facility. Enterprise-wide data collection, linked to automated analysis, helps the security department discover potential risks that may be arising and then take steps to protect other locations, even if they have not yet been struck with that type of incident.”

The purpose of enterprise-wide data collection is to discern trends across the entire enterprise. Harting points out, “If you can solve a problem in one place, you may well be able to solve it elsewhere.”

The Approach

From Legacy Software to Perspective, Through Standardization & Teamwork

Some of the five businesses were using Incident Management software, but the goal of unifying the effort called for stepping up to an even more powerful solution. Harting observes: 

“When I saw Perspective, I urged everyone to move to this new tool.”

The advantages of upgrading to Perspective, and of implementing it across all five businesses, were attractive. The tool would lead to process standardization and data centralization, and it would employ thoughtful automation to create incidents out of activities and keep related data together and viewable with a click.

In addition, Perspective would be able to integrate with other software. For example, it would help create an internal scorecard to give management a high-level overview of Raytheon’s security posture.

Security staff recognized that transitioning from the legacy system would take time, as Perspective offered greatly expanded tracking and reporting options. For example, the software would be able to capture not only a narrative but also interviews of involved persons; records of persons, items, and vehicles; supervisory reviews; expanded investigation and case management including chain of custody and assignments; and corrective action summaries. All of this data could then be compiled into comprehensive reports, metrics and analysis through the dashboard charts, standard reporting and ad hoc query tool called Analysis Expert. In addition, the new system would have to accommodate the different security processes and needs at the various businesses. For example, persons inputting data, from any business, would need to use a common nomenclature for incidents.

The solution to these implementation challenges was to form an enterprise-wide team. The team, consisting of 18 employees from a broad range of businesses and departments, began meeting weekly to advance the implementation of Perspective across the corporation. 

In particular, the team was tasked with creating a standard set of incident management usages and terms for all of Raytheon’s businesses. Harting explains:

“Up to now each of our businesses has handled data collection differently. We are now attempting to harmonize practices for companywide standardization including nomenclature. For example, in one state a particular crime is classed as a theft while in another it is classed as a burglary. We are trying to use the same terminology across the country.”

Easing the implementation is the fact that:

“Perspective’s incident process matches up with the investigation and incident management process of almost any company. Perspective fits like a glove.”

Raytheon has enjoyed a successful implementation of Perspective not only because of the enterprise-wide team and Perspective’s accommodating design, but also because of their thoughtful, focused training, skilled implementation specialists, and thorough documentation. Harting sums up the Perspective rollout this way: “Good trainers, good documentation, little need for cheat sheets.”

Well Under Way

Three of the company’s five businesses are now using Perspective, and they have successfully added the Dispatching component and set up a number of workflow notifications. Global Headquarters, Raytheon Missile Systems, and Space and Airborne systems are inputting security activity and incident data into the shared system, using common terminology. 

Perspective is able to accommodate Raytheon’s intensive use of the system. Raytheon has approximately 150 users in Perspective, likely approaching 200 soon, and more than 20 users are simultaneously logged in at any given time.

As the implementation proceeds and gradually spreads to other Raytheon businesses, Harting is enthusiastic. “The service and support we receive on the product is excellent,” he observes. “When I reach out, I promptly receive a response. During a recent software upgrade, our IT group said that the technical support answered all our questions and got everything resolved in an impressive amount of time.”

Although Perspective is highly customizable to fit an organization’s needs and processes, Harting points out a particular plus:

“What’s impressive, and even surprising, about Perspective is that pretty much right out of the box, we could use it. We didn’t have to reinvent the wheel with an expensive custom solution that may, or may not, have worked and would have been challenging to maintain, nor did we have to spend a ton of time reworking Perspective to fit our security structure and process.”

The Benefits

From Solving Specific Problems to Painting the Big picture for Top Management

Now that Raytheon has implemented Perspective, in three of its five businesses, Harting has been able to discern very clearly some of the system’s benefits. Those benefits are both general (e.g., strategic decision support) and specific (e.g., reduction of specific types of violations). Perspective brings numerous specific benefits to Raytheon:

Enterprise-wide intelligence. Before Perspective was implemented, Raytheon had no ready way to discover all the potentially security-relevant information about a particular employee. Such information might reside in a variety of Raytheon databases and files (e.g., ethics and compliance, human resources, and legal). A person might have played different roles in different incidents; he or she could have histories as a violator, a victim, and a witness. With Perspective, Raytheon can combine data that was created by various departments into a more comprehensive picture of the employee. “Now,” Harting notes, “we can get the information and ask ourselves, ‘Given the various incidents or issues with which this employee has been involved, should he still be here? Should he be put on a particular project?”

Cost understanding. With Perspective, Raytheon gains an understanding of costs (both spent and avoided) relating to several types of incidents. Often these are NISPOM violations, such as a sensitive document left on a desk or a security container left unlocked. 

The cost of security violations like those can be significant. A security error committed on one computer may require shutting down a network of 20 computers or more. Such a shutdown is expensive in terms of productive time lost, so reducing the number of security incidents that lead to shutdowns is extremely valuable.

The ability to track these incidents led Raytheon Security to step up its security education efforts, and the company has lately enjoyed a downward trend in NISPOM and similar violations. “Presumably our security education efforts are working,” Harting explains. “As you can see, Perspective helps us measure success and save money.”

Incident tracking and reduction. With Perspective, Raytheon keeps indepth incident records and uses the software’s analysis and trending functions to realize Perspective’s ultimate goal: incident prevention. For example, by using Perspective to analyze data spills, Raytheon discovered that its customers were not taking the necessary measures to keep their confidential data secure. Armed with evidence, Raytheon showed its customers the trend and made a case for them to improve their data protection measures. “By documenting the data spills and presenting the trend evidence to clients,” Harting notes, “we were able to curb the spills.

Missing item tracking and recovery. The degree of detail that Perspective captures regarding security incidents and activities makes another benefit possible: partnering with the information technology department regarding asset theft. Harting explains, “When a laptop is stolen or otherwise goes missing, the loss is reported to dispatch, and the incident is added to Perspective. Now we can give the IT Department a detailed report on each theft, and later they can check whether the computer they are looking for has been found.”

Security activity tracking. With Perspective we also have the opportunity to discover trends in security activities. These are not incidents (meaning there is no underlying security or legal violation) but are specific tasks security personnel perform for the company. Harting says: “We find activity trends, such as how many times officers are called to give employees’ cars a battery jump or perform other tasks that benefit Raytheon.” Tracking such activities provides another measure of security’s value to the company.

In addition, Harting identifies several general benefits of using Perspective:

  • With the improved ability to spot trends and identify vulnerabilities, Raytheon can properly assess the “health of security” in all the company’s programs.
  • Security professionals can detect problems and describe them so program managers can solve them.
  • With Perspective, Raytheon gathers important, security-related information not only for customers but also for the business as a whole.

“We are also excited about the new dispatching component,” Harting says. “It fits really well into Raytheon’s system.” Raytheon dispatchers can now enter all calls for security service into a security activities log. Security activities and calls for service differ from incidents, yet all are worthwhile to track because of the value that can be extracted from the data. A few of Raytheon’s dispatch centers now have Perspective up and running, with active users around the clock.

In addition, Perspective’s Workflow feature helps users identify and respond to critical and timesensitive data related to incidents, investigations, and cases. “What Workflow does for us,” Harting explains, “is automatically find trends and automatically send reports.” It reduces work for frontline staff by streamlining and automating routine, step-by-step processes. Harting notes:

“It’s time for security to do more data collection and analysis. Now we have a user friendly tool for doing so, and I can present findings to leadership so they can move the company in the right direction.”

The Future

Fuller Implementation Leading to More Powerful Intelligence

Harting distills his experience as follows:

“Perspective is invaluable. We looked at other software providers, but this product is focused on corporate security, and the company is constantly moving forward. I’m always excited to see what’s coming next.

Moreover, we have a great partnership. We learn from each other.

As for the future, we are excited to see what Perspective can do for the company once the whole enterprise is collecting data in a unified, harmonized fashion. We look forward to being better able to detect enterprise wide vulnerabilities.”

Harting says he is confident in Raytheon’s ability to adapt to an enterprise-wide, unified incident management and reporting system, and in Perspective’s reliability and capability to grow as Raytheon does.

Fill out the form to learn how Resolver can help you