SparebankenVest

The bank had been protecting email and endpoints with a multi-tenant email gateway solution, a traditional antivirus product and out-of-thebox security measures. But with ransomware and email fraud attacks on the rise, the bank’s IT team knew that it needed better defenses.

“We had no insight into what was happening,” said Thomas Skogstrand, manager of IT operations for Sparebanken Vest. “We could not configure or monitor protection from the partner’s platform and had no reports into attackers, threat vectors or how threats might spread.”

Banking customers and partners began requesting additional security measures to ensure that emails were valid and confidential. They requested Transport Layer Security (TLS) for data encryption across email channels. Implementing TLS was costly for the bank—each TLS connection or change cost €1,000.

“Banks also are targeted by cyber criminals like the Carbanak gang, who have successfully breached banks in 40 countries,” said Anders Lunde, IT technology architect at Sparebanken Vest. With so many new attack vectors, we needed a more powerful solution to protect our assets and deliver attack intelligence that will help us strengthen our defenses.”

New solution “must-haves”
The team wanted a turnkey, cloud-based solution that delivered as much threat intelligence as possible out of the box. It had to integrate with Splunk so that the bank could correlate email security and other events from across its enterprise security systems. It also had to work for all users as they are migrated from Microsoft Exchange to Office 365.

“We learned about Proofpoint from the Gartner Magic Quadrant and from sharing intelligence with other banks,” said Skogstrand. “A proof of concept was our next step.”

The team first evaluated Microsoft Advanced Threat Protection (ATP) with consultants and users in several offices. It didn’t deliver the insight or logging that the team needed. It also generated high numbers of errors. The team considered a Cisco appliance with Microsoft ATP and Cisco Advanced Malware Protection software. But Cisco didn’t offer a cloud option.

“With a team of three focused on security, we wanted a simple solution that didn’t require extra equipment or support,” said Lunde. “We also wanted products that were designed to work together.”

The perfect bottom line
Sparebanken Vest tested the following products:

• Proofpoint Email Security and Protection
• Proofpoint Targeted Attack Protection (TAP)
• Proofpoint Email Data Loss Prevention
• Proofpoint Email Encryption

Norwegian banking authorities, which must approve all new cloud deployments in the EU, also evaluated the trial. Proofpoint demonstrated great flexibility in changing email routing, which would simplify Office 365 email migration. It delivered the insight that the team needed—both through the dashboard and its ability to export data to Splunk. Finally, Proofpoint earned a superior score for stopping spam and detecting malware.

“We were happy to go with Proofpoint,” said Lunde. “We gained insight into what was happening with email and deployed the entire solution within a week.”

With DMARC deployed, Proofpoint immediately freed the team from generic, timeconsuming spam email. Proofpoint TAP delivers precise, actionable intelligence that gives the bank better visibility into its threat landscape.

“Proofpoint TAP has a high detection rate of 99% and handles threats for us,” said Skogstrand. “We receive very few alerts, and when we do, we know that they are important.”

The team can pull security intelligence and data directly from the Proofpoint TAP dashboard. Now it can trace threats accurately, seeing the original email, recipients and who clicked. As it integrates Proofpoint and Splunk, it plans to automate key processes.

“Proofpoint delivered a feature-rich solution,” said Lunde. “We’ve been able to eliminate 250 TLS connections for a savings of €250,000 in encryption alone.”

Sparebanken Vest is well on its way to becoming a security leader among Norwegian financial services companies. By stopping threats trying to enter the company through email, the bank has all but shut down the most common—and successful—threat vector.

“Proofpoint provides a powerful arsenal of tools that work exceptionally well together to protect us and provide visibility into the greater threat landscape,” said Skogstrand. “We don’t worry, because Proofpoint is working transparently 24x7x365. We rely on it.”