SparebankenVest
The Challenge
- Prevent disruption from cyber threats entering through email
- Secure email channels and validate email messages with customers and partners
- Gain visibility into email-based threats and security events
The Solution
- Proofpoint Email Security and Protection
- Proofpoint Targeted Attack Protection (TAP)
- Proofpoint Email Data Loss Prevention
- Proofpoint Email Encryption
The Results
- Stopped spam and cyber threats
- Eliminated €250,000 in encryption costs
- Gained granular visibility into email events and threats
- Integrated with Splunk for enterprise-wide event correlation and automation
The Challenge
The bank had been protecting email and endpoints with a multi-tenant email gateway solution, a traditional antivirus product and out-of-thebox security measures. But with ransomware and email fraud attacks on the rise, the bank’s IT team knew that it needed better defenses.
“We had no insight into what was happening,” said Thomas Skogstrand, manager of IT operations for Sparebanken Vest. “We could not configure or monitor protection from the partner’s platform and had no reports into attackers, threat vectors or how threats might spread.”
Banking customers and partners began requesting additional security measures to ensure that emails were valid and confidential. They requested Transport Layer Security (TLS) for data encryption across email channels. Implementing TLS was costly for the bank—each TLS connection or change cost €1,000.
“Banks also are targeted by cyber criminals like the Carbanak gang, who have successfully breached banks in 40 countries,” said Anders Lunde, IT technology architect at Sparebanken Vest. With so many new attack vectors, we needed a more powerful solution to protect our assets and deliver attack intelligence that will help us strengthen our defenses.”
Thomas Skogstrand, Manager of IT Operations
The Solution
New solution “must-haves”
The team wanted a turnkey, cloud-based solution that delivered as much threat intelligence as possible out of the box. It had to integrate with Splunk so that the bank could correlate email security and other events from across its enterprise security systems. It also had to work for all users as they are migrated from Microsoft Exchange to Office 365.
“We learned about Proofpoint from the Gartner Magic Quadrant and from sharing intelligence with other banks,” said Skogstrand. “A proof of concept was our next step.”
The team first evaluated Microsoft Advanced Threat Protection (ATP) with consultants and users in several offices. It didn’t deliver the insight or logging that the team needed. It also generated high numbers of errors. The team considered a Cisco appliance with Microsoft ATP and Cisco Advanced Malware Protection software. But Cisco didn’t offer a cloud option.
“With a team of three focused on security, we wanted a simple solution that didn’t require extra equipment or support,” said Lunde. “We also wanted products that were designed to work together.”
The perfect bottom line
Sparebanken Vest tested the following products:
- Proofpoint Email Security and Protection
- Proofpoint Targeted Attack Protection (TAP)
- Proofpoint Email Data Loss Prevention
- Proofpoint Email Encryption
Norwegian banking authorities, which must approve all new cloud deployments in the EU, also evaluated the trial. Proofpoint demonstrated great flexibility in changing email routing, which would simplify Office 365 email migration. It delivered the insight that the team needed—both through the dashboard and its ability to export data to Splunk. Finally, Proofpoint earned a superior score for stopping spam and detecting malware.
“We were happy to go with Proofpoint,” said Lunde. “We gained insight into what was happening with email and deployed the entire solution within a week.”
The Results
With DMARC deployed, Proofpoint immediately freed the team from generic, timeconsuming spam email. Proofpoint TAP delivers precise, actionable intelligence that gives the bank better visibility into its threat landscape.
“Proofpoint TAP has a high detection rate of 99% and handles threats for us,” said Skogstrand. “We receive very few alerts, and when we do, we know that they are important.”
The team can pull security intelligence and data directly from the Proofpoint TAP dashboard. Now it can trace threats accurately, seeing the original email, recipients and who clicked. As it integrates Proofpoint and Splunk, it plans to automate key processes.
“Proofpoint delivered a feature-rich solution,” said Lunde. “We’ve been able to eliminate 250 TLS connections for a savings of €250,000 in encryption alone.”
Sparebanken Vest is well on its way to becoming a security leader among Norwegian financial services companies. By stopping threats trying to enter the company through email, the bank has all but shut down the most common—and successful—threat vector.
“Proofpoint provides a powerful arsenal of tools that work exceptionally well together to protect us and provide visibility into the greater threat landscape,” said Skogstrand. “We don’t worry, because Proofpoint is working transparently 24x7x365. We rely on it.”