Global Food Packaging and Processing Company Secures Email With Proofpoint

Proofpoint Delivers on All Counts

With a complex, global environment, the company sought a single partner to work with to protect the company from message-based attacks. The security team invited several vendors to participate in an extensive RFP process across a wide range of requirements. Proofpoint beat the competition on all counts. And the selection of Proofpoint as the Gartner Magic Quadrant leader in the space gave senior managers the confidence they sought in moving forward with Proofpoint.

The security team started by laying a strong foundation for their email security architecture. They implemented a multi-tiered approach to meet their requirements. This began with Proofpoint Email Protection with Targeted Attack Protection (TAP) and Threat Response Auto-Pull (TRAP). TAP uses static and dynamic techniques to continually adapt and detect new cyber-attack patterns. And it analyzes potential threats by using multiple approaches to examine behavior, code and protocol. TAP also detects threats and risks in cloud-based applications and connects email attacks related to credential theft or other attacks. And it uses machine learning to observe patterns, behaviors and techniques used in each episode. TRAP analyzes messages against multiple intelligence systems and shares the results with the message security team. It can automatically delete or quarantine messages above a certain risk threshold. Or it can provide the security team with the information needed to decide manually. And that decision can be executed with a single click. Once it’s determined that a message is malicious, TRAP automatically removes all harmful content. What’s more, it can follow forwarded mail or distribution lists to their end recipients.

“The automated analysis and remediation we gained from TAP and TRAP was a game changer for us. Not only did they stop more malicious emails from getting in, but they significantly reduced the amount of manual analysis we had to do with our previous supplier,” explained the lead IT security analyst.

To fully align its solution to users’ specific risks, as well as track the success of its solution, the company used Proofpoint Nexus People Risk Explorer (NPRE). This cybersecurity risk model provides a people-centric view into the risks that the organization is exposed to. NPRE gathers threat data across Proofpoint products and translates it into risk models. It also identifies and segments employees within the organization into risk groups. And then it recommends customized security controls based on the risk group profile.

The team now had a strong foundation in place. Next they set out to prevent threats from attackers using business email compromise (BEC) and email account compromise (EAC). EAC and BEC attacks share the same goal: to fool the recipient into believing a message originates from a legitimate source to access company information. To address these problems, the team implemented Proofpoint Internal Mail Defense (IMD) and Email Fraud Defense (EFD), respectively. IMD examines internal traffic and identifies BEC and EAC signatures. And then it automatically diverts malicious traffic into a secure location for further analysis. EFD uses DMARC to verify the identity of the sender. DMARC establishes end-to-end email authenticity by keeping a list of approved users, credentials and valid domains at each endpoint. This extends email protection to the company’s many partners around the globe. And it significantly reduces security risk in their supply chain.

The company’s security team has long known that company employees are the last line of defense against email fraud. With a security awareness training program already in place, the team chose to expand their efforts in this area. They chose Proofpoint Security Awareness Training with Closed-Loop Email Analysis and Response (CLEAR). With these solutions, they get the ability to automate the employee reporting process, analysis and remediation for suspicious emails.

“CLEAR has been a huge success for us,” said the manager of information security education and awareness. “With our previous solution, if employees suspected a possible phish, they had to fill out a form and email it to IT for analysis. Now they press a button on their email toolbar. CLEAR forwards the suspect message, along with all of its details, to TAP and TRAP for analysis and remediation.”