Security Operation(SecOps) for a NBFC in India

Business Requirement & Challenges​

An industry leader in education-focused NBFC wanted to consolidate security incidents from their multiple accounts in the AWS Landing Zone along with different set of security tools stack. Planning to have automation in place for responding effectively to certain security findings, the customer wanted to have security controls to reduce the time taken in the manual response process. They also wanted to strength the overall security posture of their environment in the cloud and mitigate risks in the infrastructure.​

1. Vulnerability Management. 
2. Configuration Compliance (CSPM).​
3. Security Incident Monitoring.​
4. Threat Intelligence. ​
5. Zero Trust Network Access (ZTNA)
6. Privileged Access Management​

Solution Provided ​

1. Wazuh SIEM solution provided with integration with all the accounts in the landing zone and various security tools like DLP, EDR, WAF, etc. ​
2. Wazuh Vulnerability Management to scan all the resources in the environment for vulnerabilities and help mitigate the risks associated with it.​
3. Wazuh scan all the resources in the cloud to meet standards like ISO 27001, etc.​
4. Threat Detection based on the MITRE ATT&CK framework that provide high level overview of the tactics and techniques occurring in devices monitored by Wazuh agent on all accounts.​
5. Privileged Access Management for securing, managing and monitoring privileged accounts and activities in the organization.​
6. Cyber Intelligence, Brand Monitoring and Attack Surface Monitoring to give context to the customer’s digital risk.​

Business Benefits​

1. Automated in security operations.​
2. Next generation tools to automate quick remediation of the cyber-threats.​
3. Customized compliance dashboards.​
4. Complete Vulnerability Management solution to mitigate risks.​
5. 24*7 Real time threat monitoring based on the MITRE ATT&CK framework.​
6. Data Loss Prevention and Web Proxy

Outcome/Results​

1. Enhanced Threat Detection which improved the ability to detect and respond to cyber threats promptly.​
2. Risk Mitigation through continuous monitoring of the vulnerabilities ​

Technology Stack​

1. Wazuh SIEM/VM/CSPM.​
2. CrowdStrike EDR.​
3. ARCON PAM.​
4. Forcepoint DLP/Proxy.​
5. Accops HySecure ZTNA.​
6. Cloud Sek Dark Wed​
7. AWS Network Firewall.​
8. Amazon Guard Duty​
9. AWS CloudTrail​

PUBLISHED: 14th November 2024