Energy Infrastructure Optimizes Security with SOAR

Background

A Deloitte Insights article recently reported the energy industry is one of the top three sectors targeted for cyberattacks in the United States. And it’s clear that attacks are on the rise. Attacks on energy encompassed 20 percent of the total number of incidents reported in 2016, and there was “an extreme uptick” in early 2018 in cyberattacks targeting the electric grid in North America.

With the number of nation-state threat actors increasing and expanding their capabilities combined—and possibly intersecting—with internal threats such as disgruntled employees or contractors, the need for effective risk management is now greater than ever.

Energy Customer Profile:

The energy infrastructure company’s security operations center (SOC) team recognized the need to automate some security processes and manual tasks to improve response times and extend the reach of their internal security analysts. The company initially deployed Swimlane’s security orchestration, automation and response (SOAR) platform to manage internal corporate security processes. The SOC team integrated Swimlane with their security information and event management (SIEM) system, threat intelligence, phishing and case management solutions, among others, for an orchestrated and streamlined response to active threats.

Since deploying in early 2018, the company has expanded the use of Swimlane to encompass broader use cases to include such tasks as automating employee risk management for high-risk travel and employee verification, as well as domain, credential and host management to validate and minimize exfiltration. In addition, the company has expressed an interest in expanding the solution to other security operations throughout the company.

Some interesting usage stats include:

While the solution’s ROI has not been measured quantitatively, the anecdotal ROI has been communicated in “time savings equal to at least one full-time SOC analyst.”