Financial Institution Thwarts Penetration Test with Deception

Technology Category

Cybersecurity & Privacy - Endpoint Security
Cybersecurity & Privacy - Network Security

Applicable Industries

Finance & Insurance

Applicable Functions

Business Operation

Use Cases

Cybersecurity
Intrusion Detection Systems
Remote Asset Management

Services

System Integration
Training

The Challenge

The challenge facing the infosec team was that, like many security professionals, the volume of alerts generated by their current devices was not only overwhelming, but almost guaranteed that something malicious would slip through unnoticed. The impact to the team was that they were spending the majority of their time analyzing alerts rather than remediating threats in their system and thus were forced into being reactive to attacks once they were well underway. They recognized that they needed an accurate and efficient solution to detect attacks from all vectors and the ability to cut through the noise and generate only high-integrity alerts with zero false positives.

About The Customer

The customer is a hedge fund institution that operates under an 'assumed breach posture,' meaning that their infosec team positions their security infrastructure with the assumption that threats are within the network. They proactively seek out infections and prevent full-on breaches from occurring. The team needed a solution that would provide an early warning system to generate high-fidelity alerts for suspicious network activity. With time being the most critical resource during a cyberattack, the team knew an effective warning system would grant the visibility to react to a threat as soon as possible and derail its success.

The Solution

The team implemented the ThreatDefend Deception and Response Platform throughout their network and installed the ThreatStrike deceptive credentials on their endpoints. The solution was able to provide high-quality alerts so that the team could focus their resources on proactively addressing threats, rather than reactively. They were also able to use the ThreatDefend platform to demonstrate the security of their network and their ability to detect and shut down attacks. The platform successfully detected the Red Team and deceived them into engaging, capturing all their tactics and movements through the entire process. None of the information that the Red Team gained access to was real, and the deceptive credentials effectively diverted the attack.

Operational Impact

By having the ThreatDefend Deception Platform installed in their network, the organization was able to thwart the Red Team and pass the penetration test with flying colors.
The results of the penetration test highlight deception as an invisible and unexpected layer of security for cyber criminals looking to exploit organizations.
With their investment, the infosec team now not only has visibility into their network that was previously unachievable, but they also can operate with the confidence that they can detect and deceive advanced threats inside of their network before their critical assets are compromised.

Quantitative Benefit