Testing defenses, strengthening cybersecurity

Starting from a single email address, Shaffer’s team used IBM Security® Randori Recon software to surveil Greenhill’s external attack surface and find systems the team didn’t know were exposed to the internet. With the help of Randori Recon’s prioritization engine, Target Temptation, the team patched, reconfigured and deployed new controls to protect their most tempting targets.

Then, it was time to move beyond models to the real-world with IBM Security Randori Attack Targeted software. Shaffer authorized the software to automatically attempt critical objectives, such as accessing sensitive file shares hosted on Greenhill’s internal network. Emulating an authentic adversary, the Randori Attack Targeted platform gained initial access by executing an exploit for an undisclosed vulnerability on the company’s perimeter infrastructure.

The scenario allowed Greenhill to train an “assume compromise” scenario. When facing new exploits, misconfigurations or stolen credentials, patching isn’t a way out: teams must effectively detect and respond. This requires the right products deployed effectively, the right set of incident response processes and a team experienced in execution. The goal of the Randori Attack Targeted platform is to train and optimize these defenses.

With authorization in place, the Randori Attack Targeted software pivoted through controls to achieve persistence and lateral movement—creating an opportunity to exercise Greenhill’s detection and response capabilities. At each stage in the kill chain, Shaffer had visibility into executed actions and which defenses worked successfully, and which did not. This revealed the need for increased reporting at key points in the network, and the optimization of detection rules in the company’s SIEM solution. With changes in place, the team ran it back with the Randori Attack Targeted solution to confirm implementation and reduce “time to contain.” But that wasn’t a stopping point. The Attack-Defend process is continuous—the Greenhill team receives notifications from the solution as their attack surface changes and can test against new and emerging attacker techniques.

With the combination of Randori Attack Action Reports and Randori Recon Target Temptation, Shaffer can measure efficacy—what’s working, what’s not—and better invest across his security program. “Seeing authentic attacks on our network gives me a powerful narrative to share with leadership,” Shaffer says. “I can validate what’s working and build up my team.” Through the adoption of a unified offensive security platform, Greenhill is able to act faster, drive team efficiencies and extend its security expertise.

Greenhill (link resides outside of ibm.com) is a leading independent investment bank focused on providing financial advice globally on significant mergers, acquisitions, restructurings, financings and capital advisory to corporations, partnerships, institutions and governments. Headquartered in New York City, Greenhill employs 400 people and has offices across North America, Europe, and Asia-Pacific, and an alliance partnership in Israel.