PPM 2000 Case Study:
Optimizing Resources, Shrinking Losses—
Perspective at Microsoft’s Global Security Operations Centers

Case Study Overview:

Subject: Microsoft Corporation
Location: Redmond, USA; Reading, UK; Hyderabad, India
Products: Perspective Premium, Perspective e-Reporting

The Challenge

Microsoft Corporation, the world’s largest software company, runs three Global Security Operations Centers (GSOCs) to help protect its human, physical and information assets around the globe.

With hundreds of thousands of employees and a vast number of facilities, equipment, vehicles and other assets on six continents, Microsoft’s potential loss exposure is huge and complex.

To keep track of incidents and investigations—and to provide real-time redundancy across its three GSOCs—Microsoft needed powerful, flexible and highly compatible software.

The Perspective Solution

Microsoft Global Security’s solution for incident data management for security operations and investigations: Perspective by PPM 2000™.

Currently deployed in all three of Microsoft’s Global Security Operations Centers, Perspective:

• Creates efficiencies and cost savings by enabling more efficient data capture and report routing.
• Creates new capabilities, such as trend-spotting and investigation support.
• Brings the entire workforce into the security function by empowering personnel to report incidents.

The Results

Since its implementation in 2006, Perspective has helped to:

• Reduce incidents, including thefts of/from cars at corporate headquarters.
• Track and respond to people who threaten or inappropriately try to approach Microsoft employees.
• Reduce the labor required for collecting incident data.
• Make the entire Microsoft workforce a more effective part of the security effort by empowering them to report incidents online.
• Deliver cost savings, scalability and business continuity.

Full Case Study:

The Company

Microsoft Global Security uses Perspective to manage its physical security incidents, investigations and cases around the globe, benefiting from convenient integration with Microsoft Outlook and a Perspective web form through which anyone on the Microsoft network can easily file an incident report.
This study examines:

• The fundamental design and principles behind the GSOCs;
• The various ways in which Microsoft Global Security integrates Perspective into its operations;
• Three specific types of losses that Microsoft is reducing based on Perspective’s actionable intelligence; and
• The many other benefits Microsoft gains from its Perspective solution.

The Challenge

Microsoft’s Global Security Operations Centers (GSOCs)—Microsoft Global Security has a lot to keep track of, protecting corporate resources at close to 700 sites in approximately 100 countries. It monitors more than 27,000 pieces of hardware—including access card readers, cameras, fire panels, environmental alarms, biometric security systems and duress alarms—and manages more than 185,000 active cardholders and more than 30 million system events each month. The GSOCs also serve as communication hubs, and they dispatch site security personnel as needed. The primary GSOC is in Redmond, Washington at Microsoft headquarters. Secondary GSOCs are in Reading, United Kingdom and Hyderabad, India. Each GSOC focuses on a particular region of the world.

Back in 2005, Microsoft Global Security recognized that their traditional security strategies were becoming cumbersome and costly. To create a more streamlined and effective security solution, they strategically chose to make optimum use of information technology and to base their new approach on configurable, off-the-shelf software as much as possible. Instead of struggling with expensive custom solutions, Microsoft Global Security decided to combine commercial Microsoft programs with software from Microsoft Certified Partners, such as PPM 2000.

Microsoft designed the GSOCs and their information network to be capable of global workload sharing. In other words, if a particular GSOC has to focus all its efforts on a major incident—or if a catastrophe puts it out of operation—it can transfer its regular operational and technical responsibilities to another GSOC which will then have oversight for both regions.

When planning the company’s physical security operations centers, Microsoft Global Security managers agreed to several design principles including deterrence, remote monitoring, precision response, off-the-shelf infrastructure, defense in depth (layers of protection), investigative support, reliability and sustainability. In addition to its incident and investigation management functionality, Perspective was evaluated based on its ability to support these fundamental design principles.

The Perspective Solution

“Perspective is a very robust app,” says Brian Tuskan, Microsoft’s Senior Director of Global Security Technology & Investigations. The GSOCs use both Microsoft software and third-party applications. “We chose Perspective because it works on our Microsoft platform and provides great reporting and analytical functionality.” Microsoft deployed Perspective in 2006 and, by serving as an early adopter of Perspective, “we aided in its development, sharing our needs and providing feedback.”

Before incident data can be used, it must be collected. By making data collection easy and accurate, Perspective casts a wide net, capturing data from numerous sources. At Microsoft, Global Security officers and managers perform most of the data input, but Perspective also features a web-based module (e-Reporting) so that non-security employees can file incident reports online. Mr. Tuskan explains:

“We have a total workforce of over 90,000 full-time employees and thousands more that come and go through the Microsoft campuses. With such large numbers, there are inevitably losses, thefts and suspicious circumstances. With Perspective, all of these people have become part of the security reporting process.”

This approach puts a new twist on the term “enterprise security risk management,” bringing the whole enterprise (all employees and contractors) into the task of managing security risk.

Incident management.

Once a report is made, Perspective helps direct it to the right place and tracks its status. At Microsoft, a Perspective incident report first goes to the Operations Team, which reviews it and escalates the report as appropriate. For example, a theft or threat report would be forwarded to the Investigations Team while a network security incident report would be passed to the Network Security Team. States Tuskan:

“We use Perspective like CRM [customer relationship management] software specific to the security industry. It helps us collect reports, pass them to the right team and track the issue until it’s resolved.”

The GSOCs play an important role as communication and dispatch centers, so Microsoft also uses Perspective to track calls for service.

Analytics.

In a large organization, it is common to have a series of incidents, such as car break-ins or thefts from offices. First, Perspective helps security personnel detect the series; then, it helps them put an end to it. According to Mr. Tuskan:

“One of the most important functions of Perspective is its analytical capability. We use it for trending. We have a full-time analyst here who can pull reports and paint a picture for us. Perspective helps the analyst create actionable intelligence for investigations and operations.”

Such “actionable intelligence” might include a finding that employee vehicle thefts are occurring mostly between 2 pm and 4 pm from two parking lots in particular. Perspective quickly identifies the modus operandi (or MO) and helps Microsoft focus its investigations and preventive measures. Mr. Tuskan adds, “Sometimes we use the information from Perspective to devise our own response; other times, we provide the data to law enforcement to aid their response.”

Intelligence database.

Aside from analytics, Microsoft also uses Perspective as a powerful, practical database. Mr. Tuskan notes:

“Perspective makes it easy to collect, access and track data. When an incident occurs, the data goes in, and we immediately have access to the information we need to make mission critical decisions.”

Investigators and other Global Security personnel can easily tap the many information points compiled in Perspective’s incident and investigation records. In a less sophisticated system, it would be difficult to compile, search and preserve the thousands of pieces of data regarding security-related incidents, items stolen, known or suspected offenders and other loss details. Perspective not only improves the quality and quantity of the data captured, but it preserves that data in a secure format for future use.

The Results

Microsoft cuts crimes and other losses with Perspective.

Microsoft Global Security has successfully used Perspective to address several specific security concerns, including vehicle break-ins, laptop thefts and potential threats against Microsoft employees.

Car break-ins and thefts of cars.

At the Redmond campus alone, some 30,000 employee and contractor vehicles are registered for on-site parking. In the past, these vehicles have presented an attractive target for criminals who were stealing the vehicles or breaking in and taking their contents. In addition to the property risk, the criminal activity also presented a hazard to Microsoft personnel who ran the risk of interrupting a criminal and facing a confrontation.

Microsoft Global Security captured details about the vehicle-related crimes in Perspective. They then used Perspective’s analytical features to identify commonalities in the offenders’ MOs (such as times, locations and types of cars targeted). Global Security shared that information with Redmond Police who used these insights to target their enforcement efforts. With the intelligence gained from Perspective, the police were able to make multiple arrests.

In addition, Microsoft Global Security used Perspective’s analytical features to guide its own prevention efforts. Because Perspective helped Microsoft analyze the problem and focus the company’s and law enforcement’s responses, Mr. Tuskan notes, “the series of thefts reduced significantly.”

Laptop theft/loss.

Not surprisingly, a high-tech, large-workforce company like Microsoft is vulnerable to the theft and loss of laptop computers. Mr. Tuskan observes:

“By trending with Perspective, we changed our security approach and cut laptop thefts in half.”

That success is even greater—much greater—than saving the value of the computers themselves. Preventing laptop thefts also prevents the productivity losses and data security issues that follow the loss of a computer.

Threat management tracking and prevention.

Inappropriate activity directed at employees is a rising problem in large corporations, as is reflected in the growth of the workplace violence/threat mitigation field. Mr. Tuskan explains how Microsoft uses Perspective to address that concern:

“With Perspective, we can easily record and track threats or other contacts from people behaving inappropriately toward our employees or assets. Oddly-behaving persons may send written threats or may try to physically approach our employees. We document these threats and, with Perspective, can easily spot connections.”

The security response would likely differ if a person inappropriately approached an employee once versus if he approached the employee repeatedly, but—without Perspective’s detailed incident tracking—multiple approaches by a single person can be difficult to detect. With Perspective, the Global Security Team can quickly connect the dots and respond as needed.

Other Benefits and Advantages

A Microsoft white paper (“Microsoft Global Security Showcase: Physical Security at Microsoft: Taking Advantage of Strategic IT Convergence,” April 2009) lists several benefits to Microsoft’s GSOC approach, including reduced costs, scalability and business continuity. Perspective contributes on all fronts.

Loss reduction and operational cost savings.

Mr. Tuskan also notes that cost savings come from both a reduction in thefts and a reduction in labor:

“With Perspective, we thwart or prevent major theft trends. Over time, savings easily run in the high hundreds of thousands to millions of dollars through theft prevention, recovered property and physical security labor reduction. Perspective, for example, made possible the efficient reporting of laptop thefts. We used to send an officer to take a report. Now, we use Perspective’s web-based incident reporting feature, e-Reporting, which is easily accessed by all employees and vendors to report thefts and other security-related incidents.”

For Microsoft, the return on its Perspective investment has been substantial. It includes:

• Loss reduction;
• Labor savings;
• Increased efficiency;
• Intelligent resource allocation; and
• Unknown numbers of prevented high-impact incidents.

Scalability.

Perspective also helps Microsoft attain its goal of scalability. Mr. Tuskan observes:

“We use Perspective globally. Information flows into Perspective from all over the world. The software’s scalability is truly enterprise-wide, and the software can grow as we grow.”

Perspective accommodates not only increasing numbers of incidents but also increasingly sophisticated use of the product’s capabilities. According to Mr. Tuskan:

“Perspective includes a long list of tools that not every user would use at first or at all. However, as a user becomes more sophisticated or the enterprise grows larger, Perspective has the necessary functionality already built-in. It works for businesses of any size, small to large. A user can discover more of Perspective’s features over time, as needed, the way one does with familiar products like Microsoft Outlook. And, like Outlook, Perspective has many features that new users might not take advantage of, but that they can gradually put to use as their needs and expectations evolve.”

Business continuity.

“Perspective is a working part of our business continuity plan,” Mr. Tuskan explains. If the Redmond GSOC goes down, the Reading, UK or Hyderabad, India GSOCs can take over and serve in its place. In that case, Perspective will continue to function as usual. In fact, security staff members in the UK or India would be able to make decisions based on up-to-date Perspective data and then actually dispatch a security officer in Redmond using radio frequency over IP.

Moving forward, Microsoft Global Security continues to use and benefit from Perspective. Mr. Tuskan concludes:

“Perspective is definitely worth the investment. Its features and scalability help us manage enterprise security efficiently and effectively, and we routinely showcase Perspective to organizations looking for cost-effective reporting and analytical tools.”

Acknowledgements

PPM 2000 would like to thank Brian Tuskan and Microsoft Corporation for sharing their experiences with Perspective. For more information on Perspective or any of the topics discussed in this case study, please contact PPM 2000 directly at information@ppm2000.com or visit us at www.ppm2000.com.

Download the case study in PDF format…

Read more Perspective Case Studies:

› Camberry Casinos
› Fulton Financial
› Delta Air Lines
› Shawnee Mission Medical Center
› The Legislative Assembly of Ontario