Use Cases

Financial Services at
the Center of the Bullseye

According to Forbes, financial services firms fall victim to cybersecurity attacks 300 times more frequently than businesses in other industries. This is not surprising given that financial organizations have and manage what criminals want most: money.

The security challenges financial services firms face include:

• New data breach legislation such as GDPR and the California Consumer Privacy Act that require organizations to significantly strengthen their ability to detect and respond to cyberthreats quickly.
• Expanded attack surface as firms are embracing decentralizing their networks and migrating their IT workloads to the cloud. Bad actors target unsecured servers and vulnerable applications, as well as steal credentials to gain access to public cloud platforms. Once they have access, the attackers can launch new instances and move laterally to initiate attacks on other workloads, ultimately harvesting and exporting data.
• Advanced threats that evade detection and operate at will in a network. Attackers engineer the threats, such as the Emotet banking Trojan, to avoid detection by even next-generation security technologies. Attacks are designed to infiltrate a specific financial institution’s network after patient research of the target organization, its security controls, and those of its network of service providers and vendors.
• The high volume of attacks that financial services security teams face. Their organizations experience thousands of attacks every day targeting employees, critical infrastructure, systems, and applications.
• Limited resources increase the tremendous strain on security teams. Most regional and branch locations lack advanced security controls; those measures that they do have are notorious for not detecting attacks or for generating false positives when they do generate an alert. The result is that any legitimate alerts of malicious behavior are buried under a mountain of data from across the network.

AI-Powered Network Security for Financial Services

Financial services organizations look to Lastline to enhance their defense-in-depth security strategy of both on-premises and cloud environments to detect the anomalous behavior that indicates an attack has penetrated the perimeter.

Lastline utilizes AI to sift through the huge volume of malicious activity directed at financial services organizations. Lastline Defender combines three complementary techniques to deliver superb threat protection:

1. Leveraging the Lastline Global Threat Intelligence Network to scan traffic metadata and payloads for variants of known threats
2. Applying unsupervised AI to network traffic to detect protocol and traffic anomalies along with other indicators of compromise
3. Using supervised AI to automatically create classifiers that recognize malicious network behaviors and previously unknown malware.

Together, these three techniques deliver unmatched visibility of malicious behavior, enabling under-resourced security teams to stop advanced attacks at multiple stages across the attack chain before they result in a data breach. Lastline Defender:

• Monitors network traffic entering and exiting the network (“North-South”), traffic within the network (“East-West”), as well as host activity on the network.
• Detects the initial network penetration, malicious activity of the threat as it moves laterally across the network, anomalous behavior of compromised systems, transfers of data across the network, and external communication with the attacker.
• Provides the same ability to stop threats entering or operating within public cloud environments as it offers for on-premises networks.

Benefits

The benefits for financial services organizations to using Lastline Defender include:

• Visibility – The security team can visualize every stage of the attack chain as an attack progresses across the network from initial compromise to data exfiltration for both on-premises and cloud environments.
• Accuracy – The highest fidelity detection on the market today, as proven by earning the highest score in NSS Labs’ breach detection group test for the last four years.
• Knowledge – Backed by our deep expertise on malicious behaviors and the threat details captured in our Global Threat Intelligence Network, Lastline Defender eliminates the need for extensive research by incident response teams.
• Speed – Automatically block threats at multiple stages of the attack chain due to high-fidelity insights and very low false positives. Security teams also can integrate Lastline Defender’s AI-powered network security into incident response workflows and custom applications throughout the organization, whether on-premises or in the cloud, to accelerate and simplify incident response.