A foreign financial institution

Background

After several years of construction in accordance with Global standards, the security defense system has reached a relatively high level, and there is a need to improve security operations capabilities (tools, people, processes);

A joint venture was recently established with a domestic third-party payment company, connecting applications and networks. The security defense capabilities and security operations capabilities need to reach the same level.

Requirements

There is a need to discover weaknesses in the security defense system from an attacker's perspective, targeting different attack stages and techniques;

Improve the operational capabilities of the security operations team (improvement of platform capabilities, improvement of personnel capabilities, and verification of the accuracy and rationality of the response process);

Quantitative evidence is needed to support future security planning.

Current Situation

The defense system already includes:

Network security, endpoint/host security, email security, data security, AD security, cloud security, application security, and code security;

Security operations team, SOC, SOAR, threat intelligence, and other platforms;

Incident response processes, compliance processes (domestic, international, financial).

Services Provided by ThreatVerify

Provides the ThreatVerify Security Metric Validation Platform, using a rich variety of simulated attacks covering various attack stages and techniques to realistically simulate in production environments and discover weaknesses in the defense system;

Integrates with the SOC platform to obtain alarm logs of various security products, achieving closed-loop validation and determining whether relevant security defense measures have normal responses;

Continuous periodic validation to monitor drift in security defense capabilities caused by environmental changes, allowing for timely discovery and correction.

Implementation Results

Achieved examining and building our own security defense system from an attacker's perspective.

Improved the operational capabilities of the security operations team (platform capabilities, personnel capabilities, and validation of the accuracy and rationality of response processes).

Saved 95% of the work required for penetration testers to achieve validation; reduced the number of junior penetration team members by 50%; and reduced the impact of human factors (areas of expertise, turnover, working hours) on validation work.

In the first quarter of implementation, 48 optimization strategies for endpoint/host security products were achieved, and 1 new security defense measure was recommended to be added.