A certain bank credit card centre

Project Background

Compliance Background: Cybersecurity Law, Data Security Law, MLPS 2.0, GBT 39204-2022 Cybersecurity protection requirements for critical information infrastructure, PCI-DSS;
Current Security Construction: A large number of security protection devices have been deployed, regular security assessments are conducted, and a Security Operations Center (SOC) has been established.

Requirements

Increase the frequency of regular drills, verify the effectiveness of existing security technical measures, and meet the verification requirements in "security management construction";
Improve the operational capabilities of the security operations team (platform capability enhancement, personnel capability enhancement, accuracy and rationality of incident response processes);
Provide support for Blue Team construction.

Current Status

The defense system already includes:
Network, endpoint/host security, email security, data security, vulnerability management, identity security, advanced persistent threat defense, application security, code security, etc.;
Security operations team, SOC, threat intelligence and other platforms;
Security incident response processes.

Services Provided by ThreatVerify

Provide the ThreatVerify Security Metrics Validation Platform to perform attack simulations with rich APT attack scenarios covering various attack stages and techniques, simulating them in real production environments to discover weaknesses in the defense system;
Link with the SOC platform to obtain alarm logs of various security products, achieve closed-loop verification, and determine whether relevant security defense measures respond normally;
Continuous periodic validation to monitor security defense capability drift caused by environmental changes, and to detect and correct them in a timely manner.

Implementation Results

Acquired the capability to self-assess the effectiveness of current various security defense measures, meeting compliance requirements;
Improved the operational capabilities of the security operations team (platform capabilities, personnel capability enhancement, accuracy and rationality of incident response processes). In the first quarter of implementation, 5 correlation analysis scenarios were added;
Reduced the number of junior penetration testers by 50%; reduced the impact of human factors (areas of expertise, turnover, working hours) on verification results and progress;
In the first quarter of implementation, 35 WAF product policies were optimized, and 2 new security defense measures were recommended to be added.