Transforming Healthcare Cybersecurity with NGSIEM

Background 

A major investment, wealth management, and brokerage enterprise serving millions of investors daily on its trading platform. Faced growing security risks, including potential breaches compromising customer accounts.The organization required a modern, scalable security solution to protect its reputation and support rapid business growth.

Challenges

They had continuous yearly security breaches and needed a robust platform to detect and respond to data leakage, insider threats, and other cyber-attacks.   No unified visibility across the environment, with multiple teams managing security tools in a complex hybrid working model.  Difficulties in faster detection and response of cyber threats.

How was it solved

• The customer chose the CrowdStrike Falcon platform over strong competition from MDR platforms offered by Big 4 firms.
• POC was successfully done to demonstrate the unified security features of CrowdStrike Falcon, covering the following aspects:
• Ability to parse data from custom data sources and applications with data pipeline management (Onum)
• In-built case management and SOAR capabilities
• Best in the class threat-intel based detections of IoCs
• AI-assisted Incident Response and investigation capabilities with Charlotte AI

The Benefits

This POC helped in securing the contract win for CrowdStrike and Positka as a Managed    Security Services Provider. As a unified solution for security, the following components  were implemented: 

NGSIEM:

• 420+ OOB use cases
• 25+ data sources
• 50+ custom use cases
• Built custom parsers for more than 15 data sources

CWPP:

• Refined a large volume of noisy alerts
• Consulted on and developed detection polices for cloud workloads 

EDR:

• Assisted customers in identifying and consolidating key assets for the EDR policy rollout 
• Prioritized alerts based on the criticality of the identified assets

IDP:

• Utilized Fusion SOAR to automate the resolution of compromised accounts identified by IDP
• Refined and whitelisted benign-positive and false-positive contributors  
• Case Management:
•  Implemented Case Management that served as an ITSM
• Automated detections through Fusion SOAR and integrated them as cases.
• Create dashboards to report SOC KPIs

Charlotte AI:

•  Integrated Charlotte AI with Fusion SOAR for quicker resolutions
•  Utilized Charlotte AI in threat hunting
• Classified critical alerts using Charlotte AI

Product: CrowdStrike