Customer Story
A Leading Financial Institution
One of the world’s leading financial groups partners with BlueFort to modernise their cybersecurity estate with a Continuous Threat Exposure Management (CTEM) approach and meet CBEST compliance standards.
This organisation has a global network with approximately 2,000 locations in more than 50 countries. It employs around 160,000 people and offers services including commercial banking, trust banking, securities, credit cards, consumer finance, asset management and leasing.
Key challenges
- Reactive cybersecurity strategy not meeting the requirements of the CBEST framework, with limited consideration of the changing threat landscape
- Reliance on ad-hoc third party security testing due to in-house cybersecurity skills shortage
- Complexity of IT security estate due to decades-old legacy cyber delivering limited value
Overview of the situation
The banking sector is complex, competitive and highly regulated. Non-compliance is not an option. At the same time, financial institutions the world over are all on their own digital transformation journeys in the race to stay relevant, compete and continue to grow market share.
This combination of regulation and digital transformation created a perfect storm for the IT security teams at this global bank, where it found itself without a long-term, holistic cybersecurity strategy, a debilitating skills shortage, and a plethora of cybersecurity technologies accrued over decades, some of which delivered absolutely no purpose.
The impact of these issues on the bank’s cybersecurity posture was huge. The IT security team came to rely on a roster of ad-hoc, external consultants, leading to a lack of continuity around the bank’s IT estate. Project delivery and documentation deadlines were routinely missed. The team was so time-poor that all efforts were focused on keeping the cybersecurity lights on from day to day. There was no time to consider the latest threat landscape and the implications that could have.
“BlueFort provided professional services to help throughout the project. We can’t have SMEs for everything and with the speed that the security landscape changes it’s better for us to lean on the experts.”
“We are working with security infrastructure so we cannot afford to take any risks. We like the assurance that we have BlueFort experts doing all the heavy lifting.”
EMEA IT Director, leading international financial group
Reducing complexity with continuous discovery, validation and control
Ultimately, there were two key drivers that led the bank to BlueFort Security:
- It wanted to align its cybersecurity strategy with Gartner’s Continuous Threat Exposure Management (CTEM) approach. This is a framework that CISOs and SecOps teams can adopt to move from a reactive to a proactive mindset, actively prioritising risks most relevant to their organisation.
- The bank operates within the CBEST framework, now the primary method for UK financial services organisations to voluntarily test their defences using advanced threat intelligence and realistic attack simulations. It needed to ensure that its cybersecurity approach met the requirements of the CBEST framework.
Given the complexity of the bank’s current cybersecurity status, the consultants at BlueFort needed to understand, from a technical perspective, what they were working with. As in all walks of life, knowledge is power.
BlueFort’s proven methodology is built around three pillars: continuous cyber discovery, validation and control. It closely follows the five key functions of the NIST framework (identify, protect, detect, respond and recover). It also supports Gartner’s CTEM approach, which advocates for all organisations to adopt a continuous threat exposure management program to stay ahead of threats.
Rather than following standardised single vendor solution playbooks, by following this continuous methodology of visibility and validation, identity assurance, remediation and partnership, BlueFort’s consultants were able to navigate and distil the bank’s complex cybersecurity problems into a harmonised security environment that maximises both its IT security team and its investment in tooling.
Long-term focus
The partnership with BlueFort is a long-term initiative. Optimising the bank’s cybersecurity posture against changing regulations requires a continuous cycle of discovery, validation and control. BlueFort’s consultants have created a three-year roadmap for the bank and are working hand-in-hand with the bank’s IT security team. Not only does this provide an additional layer of cybersecurity support, but it helps them navigate their way towards a continuous cyber protection regime.
From reactive to proactive with Evolve
Using advanced technologies to automate mundane and repeatable tasks in the SOC team, BlueFort was able to free up considerable amounts of time and resources, enabling the bank’s IT security team to focus on strategic objectives. BlueFort’s Evolve services platform is now ensuring that the client has access to latest emerging vulnerability information, expertise on demand, and insights into new and emerging technologies.