Cisco Secures USGA Golf Championships

Implementing the right mix of technology

Previously, the USGA tried a mix of different security technologies. "We leverage VPN for IP whitelisting," says Santora. "Before Cisco, the VPN and firewall from our legacy vendor worked with minimal interruption throughout the year. But roughly one week before the championships, when there's an onrush as everyone tries to access the network, our legacy firewalls would invariably crash."

Santora points out that patching at the last minute isn't viable. "Instead," he says, "We decided to replace the legacy products with Cisco Secure Firewall. It's been six to seven years now with Cisco Secure Firewall and we have not seen an issue."

"At the championships, we deploy the same quality of solutions we have at our fixed locations," says Santora. "We enable intrusion protection system (IPS) and intrusion detection system (IDS) features of Cisco Secure firewalls and threat intelligence from Talos."

With thousands of untrusted devices, segmentation is critical for the USGA, and so is visibility into the network. At the championships, the guest networks are completely isolated. "During the U.S. Open on a given day, there are around 12,000 unique connections to public Wi-Fi and 22,000 connections overall to the network. We move roughly 13 terabytes of data for the fans alone," Santora remarks. "For us, it's absolutely critical to leverage the segmentation and isolation capabilities of Cisco Secure Firewall. From a fan perspective, we use Layer 2 wireless isolation in our Wi-Fi networks."

Santora's team uses Cisco Umbrella DNS and Cisco AnyConnect with Duo to secure the staff network at the championships. “We use Umbrella DNS to ensure we remain secure with the websites our staff visit and to have visibility into any adversary-in-the-middle type of attacks,” Santora explains. “We use Cisco AnyConnect and Duo to ensure that when our championship employees and staff are away on the road, they connect to our wireless access point through an encrypted tunnel, leveraging both Cisco Secure Firewall and multifactor authentication (MFA) with Duo.”

“The IT team is considering adding the full Umbrella suite and solutions around Cisco XDR (Extended Detection and Response)," Santora says, "We are excited about Cisco XDR in seeing what Cisco is doing in that area."

Advancing golf using Cisco solutions

With Cisco, the USGA can achieve outcomes from both business and security perspectives. "Cisco technology is an enabler for us," Santora remarks, "The last thing we want is to police nearly 30,000 devices at our championships. The key benefit of Cisco Secure Firewalls is isolation and segmentation. We can allow fans to do what they want without impacting anyone else. This contributes to a superior fan experience. If you can't see anyone else, you can't harm anyone. In that sense, isolation gives us more or less zero trust."

In addition, Santora remarks, "The IPS and IDS capabilities of Cisco Secure Firewall stand out. They have so much more horsepower and deliver exactly what we need for high volumes of connections."

Availability, speed, and timeliness are integral to the security outcomes the USGA achieved with Cisco products. "Time is critical for our photographers and videographers. You can't post to social media an hour after the event if a major thing happened there on the course," Santora explains. "The photographers individually transfer terabytes of data daily, going right onto the Wi-Fi dedicated to them, uploading their files to the cloud with no issues. Their content gets uploaded in real-time. That's a very high level of SLA with Cisco networks."

Cisco provides the USGA with a reliable and secure foundation for innovation. Santora says, "Besides showing scoring data, fans can use our mobile USGA app as a navigation tool with wayfinding features. Wayfinding helps fans navigate the course to get to that hole or reach their favorite player. If we didn't have that underlying network, we couldn't develop and implement these ideas."

A reliable infrastructure at their corporate and championship locations is a big assurance for the USGA. "During our regular penetration testing, the tester couldn't find a single port to break into the facility, data center, or internal networks. That's attributed to the RADIUS authentication we use with Cisco products. Your device will not work unless it's a USGA-issued device. This gives us such assurance," says Santora.

With Cisco, the USGA can now focus on advancing golf without spending hours fixing network issues. "Earlier, we had many VPN-related support requests just before the championships. That has now stopped. It reduced stress for my staff, but more importantly, they can now focus on our core deliverables," Santora remarks. "After adopting Cisco security solutions, our daily vulnerability scans rarely detect common vulnerabilities and exposures (CVEs). Now we spend less time patching stuff, which is a significant ROI with using Cisco."

At the championships, Cisco enables fully redundant networks offering more visibility. Santora says, "If something goes down, we receive notifications immediately to repair things quite quickly while maintaining service continuity through a different path. That's another significant business outcome."

Santora concludes, "Cisco helps us achieve the timeliness, availability, and reliability we need at our world-class golf events and brings it all together in a single pane of glass. Being a small organization, it helps us be more efficient with our spending and focus on our primary mission of advancing golf."