Redscan

The case study revolves around an independent global asset management firm with prestigious corporate investors and banking partners. The firm is responsible for managing assets for a wide range of clients and is acutely aware of its responsibility to protect all related information. The firm had antivirus software and firewalls in place, which provided an essential first line of defense. However, if hackers or malware were to penetrate these barriers, it had no means of monitoring its IT infrastructure to detect unauthorized activity on its network. The firm also needed to ensure that there were no weaknesses in its own network that might be exploited by hackers as a means of infiltrating the networks of its many financial partners. The firm was comfortable that it complied with the IT security standards set out by the Financial Conduct Authority (FCA) in the UK, and other similar regulatory bodies around the world, but it anticipated that these industry requirements would soon become more stringent.

The case study revolves around a global shipping company, one of the largest in the world, with over 135 years of experience in the industry. The company manages around 600 vessels and employs 20,000 people on shore and at sea, through nine ship management centres worldwide. The company was aware of the potential damage cybercrime could inflict on its operations, finances, and reputation, especially after the NotPetya malware attack on Maersk in 2017. The company had some security controls in place, but these did not provide visibility across its complete hybrid cloud infrastructure, including Office 365. They also lacked confidence that attacks would be identified quickly enough to minimise potential damage and disruption. With a relatively small number of IT specialists for its size, the company sought a third party to help with day-to-day threat detection, enable a more proactive approach to cyber security, and mitigate future security risks. They also needed to ensure that appropriate controls and processes were in place to meet all its data protection obligations, including the ability to detect and report breaches in line with the GDPR.

A private healthcare organisation in the UK, which processes large volumes of sensitive patient data, was targeted by a sophisticated type of malware. The malware aimed to harvest employee credentials and exfiltrate data. The organisation was already using Redscan’s Managed Endpoint Detection and Response service to protect its data beyond the level of security offered by traditional perimeter solutions. However, the malware attack posed a significant threat to the organisation's operations and the security of patient details. The challenge was to quickly identify, investigate, and respond to the attack to minimise operational disruption and prevent patient details from being stolen.

The case study revolves around a global packaging provider that delivers sustainable solutions to various industries. The company had recently undergone a process of consolidation, which led to it becoming a globally integrated business. This expansion significantly increased the company's threat profile. The company was concerned about the broader cybersecurity challenges affecting the manufacturing industry and feared that a cyber-attack could lead to system downtime, negatively impacting production and financial performance. The manufacturer relied on several specialist industrial control systems running legacy, unsupported software. The company needed to mitigate the risk of being unable to patch critical systems by enhancing its ability to proactively monitor them for threats that might exploit any unpatched vulnerabilities. The company's decision to migrate workloads to the cloud had also intensified its need to improve threat coverage and visibility. The existing SIEM system offered only limited visibility across its hybrid environment and did not provide assurance that attacks would be identified quickly enough to minimize damage and disruption.

A specialist bank identified that its security controls were not adequately addressing the potential cyber security threats it faced. Despite not having the risk profile of a Tier 1 bank, the bank was aware of its vulnerability to cybercriminals due to the large volumes of personal and financial data it processes. The risks were further increased because the bank operates across a hybrid environment encompassing legacy on-premises infrastructure and an increasing number of workloads in the Amazon Web Services cloud – including a recently launched online banking portal. The bank was experiencing a growing number of attacks and was worried about the consequences of breaches going undetected. The bank's existing SIEM technology was not providing complete threat visibility and investigating a high volume of false positive alarms was proving too time and resources intensive for the organisation’s small in-house security team. The bank needed a managed security partner that could help it swiftly identify and mitigate cyber threats both inside and outside of regular working hours, as well as help meet the requirements of the GDPR, the Financial Conduct Authority and the Prudential Regulation Authority.

A leading independent insurance broker, specializing in providing insurance advice for high-value business mergers and acquisitions, was compromised by a cybercriminal. The firm was used as a platform to launch a Business Email Compromise (BEC) attack, designed to trick one of its clients into paying two open invoices, with a total value close to £300k, into an alternate bank account. The attack was detected before any payment was made, thanks to a vigilant member of staff from the client company who insisted on verbal verification of the financial details supplied. However, the firm was keen to understand the extent of the compromise and how to safeguard against similar threats in the future. They needed support from an expert cybersecurity company to help shed light on events surrounding the attack.

A UK-based asset management company was seeking to enhance security visibility across its hybrid infrastructure and free up its in-house team to focus on remediating rather than detecting threats. The company was looking to gain more complete security visibility and obtain additional resources to supplement its in-house team and enable it to focus on critical security investigations. The company recognized the significant damage a data breach could pose to its reputation and its client relationships and wanted to minimize the potential risks. Mindful of its compliance responsibilities, the company also wanted to ensure that it was meeting the requirements of the Financial Conduct Authority and other regulatory bodies. The company had no dedicated security team and was struggling to gain a full picture of security events across its environments. The company had previously trialled a number of Security Information and Event Management (SIEM) and Endpoint Detection & Response (EDR) platforms from different providers, but couldn’t achieve the outcomes it needed from them.

The CEO and board of directors of an international trading organisation were concerned about the potential damage a cyber-attack could inflict on their operations and reputation. Despite significant investments in cyber security, they lacked visibility into the effectiveness of these defences and how their organisation would respond to a real-world attack. The Financial Conduct Authority (FCA) legislation holds senior managers personally accountable for ensuring that IT security regulatory requirements are met. Therefore, the CEO and board decided to engage Redscan’s Red Team to test the effectiveness of the company’s cyber security controls and its ability to detect and respond to malicious behaviour.

The national homebuilder, with a large and mobile IT estate, was a potential target for cybercriminals due to its dispersed workforce and heavy reliance on cloud services. The company was not consistently capturing, analyzing, and correlating security logs, leaving it vulnerable to attacks without any visibility. There were also concerns about the company's compliance with GDPR and PCI DSS requirements. The company needed a security capability that would enable it to monitor and protect important data and assets round the clock. However, with a small team, the company lacked the resources to build this capability in-house and needed a security partner to provide support and expertise.

The case study revolves around a leading private hospital in London, UK, founded in 1982, that was grappling with the challenge of safeguarding large volumes of sensitive and private patient data. The hospital, like all healthcare institutions, had to manage and maintain a wide range of specialist systems, including life-saving medical equipment. Ensuring these systems were always operational and that patient data could be accessed and shared across the network instantaneously was crucial. At the same time, the hospital had a strict duty to prevent this sensitive information from falling into the wrong hands. The hospital also had to comply with the requirements of the GDPR, NIS Directive, and Care Quality Commission (CQC), which mandate that personal data is suitably protected and breaches are promptly detected, responded to, and reported. Despite having firewalls and antivirus software, the hospital sought to improve visibility of events inside its network to detect advanced threats capable of evading these controls. The hospital's IT department, a team of six, lacked the resources to manage the technologies required for 24/7 security monitoring.

The specialist asset manager, despite having several state-of-the-art security systems and hardware solutions, was struggling to maintain its cybersecurity vigilance. The firm was receiving numerous alerts from its antivirus and perimeter security products, but it was challenging for the IT team to determine the importance of these alerts. The company was aware of the need for a team of cybersecurity experts who could monitor their systems 24/7 and respond appropriately to the alerts. However, setting up such a specialist operation in-house was not a viable option due to the high costs involved. The firm was in need of a solution that could help them filter and understand the information being fed by their security systems, detect malicious activity, and act quickly to protect the business.

A specialist bank in the UK, processing a high volume of sensitive data, recognized the need to review its approach to cybersecurity due to digital transformation and the rapidly evolving threat landscape. The bank was concerned about its increased security risk due to a recently launched online banking portal and an increasing number of workloads moving to the Amazon Web Services (AWS) Cloud. The bank had previously used other providers for penetration testing but felt the need for a fresh approach to uncover vulnerabilities that may have been overlooked. The bank sought the expertise of Redscan, with whom it already had a strong relationship, to provide in-depth insight and support its compliance with the requirements of the Financial Conduct Authority, the Prudential Regulation Authority, and the GDPR.