INVESTBANK schützt Kundendaten proaktiv und reduziert die MTTR um 80 % mit Recorded Future
Leading Jordanian financial institution INVESTBANK uses Recorded Future to get actionable AI-driven threat intelligence and streamline orchestration for more effective cybersecurity operations.
Ziel:
Ein proaktives Sicherheitsmanagement und Reduktion der mittleren Reaktionszeit (MTTR) mit detailliertem Bedrohungskontext und verbesserter Cybersicherheitsorchestrierung.
Herausforderung:
Schneller Zugriff auf genaue und umsetzbare Bedrohungsinformationen aus verschiedenen Quellen, um Bedrohungsakteuren, die es auf sensible Kundendaten abgesehen haben und Markenwerte missbrauchen, einen Schritt voraus zu sein.
Ergebnisse:
- 14+ Stunden pro Woche eingespart bei der Sicherheitslückenforschung
- 80 % weniger MTTR
- Erhöhte Kapazität und Eliminierung manueller Aufgaben durch die Automatisierung von Sicherheitsworkflows in Splunk
- Verhinderung, dass sich digitale Risiken auf Kundenbeziehungen auswirken und den Markenruf beeinträchtigen
- Priorisierung kritischer Sicherheitslücken für deren Behebung
Security and trust form the foundation of every customer’s relationship with their bank. As a leading financial institution in Jordan, INVESTBANK can’t waver on its promise to protect its customers’ most sensitive personal and financial information—and the money they’ve worked hard to earn.
"Our goal is to ensure customers feel that INVESTBANK is a true partner," said Riyad Jazmawi, Chief Information Security Officer at INVESTBANK. "INVESTBANK is one of the most innovative banks in Jordan. We rely on digital services to provide a cutting-edge digital journey to our clients. Cybersecurity is a core pillar in our business enablement strategy."
Since its establishment in 1982, INVESTBANK has built and maintained a reputation for providing customers with premium, boutique digital banking solutions and warm, tailored customer service experiences. To preserve and strengthen this reputation, they’re also determined to provide the highest level of security.
The security team at INVESTBANK vigilantly monitors for cybersecurity threats, including misuse of the bank’s branding and critical customer data leaks. They’re also responsible for protecting customers from social engineering and phishing attempts through fraudulent websites and preventing personal banking information from being sold on the dark web.
Das Team von Jazmawi steht unter ständigem Druck, Bedrohungen in diesem schnell wachsenden Ökosystem proaktiv zu erkennen und zu managen. Die Zeit ist von entscheidender Bedeutung, wenn es darum geht, Bedrohungen zu erkennen und zu beheben, bevor sie sich auf die Kunden auswirken.
Automatisierte Umsetzung von Threat Intelligence
Jazmawi and his team used to rely on open-source threat intelligence data. Although broad in scope, the data lacked accuracy and was often incomplete. It was extremely time-intensive to comb through the data and uncover quality information about relevant or pressing threats, making it challenging to mitigate vulnerabilities and take action. The time spent on this manual work also pulled his team away from other cybersecurity operations.
“We lacked visibility into what was going on on the dark web,” Jazmawi recalled. “We were unable to strengthen our cybersecurity defenses or respond to cyber threats.”
Die mittlere Antwortzeit (MTTR) ist ein zentraler KPI der INVESTBANK, und die Reduzierung der MTTR ist eine strategische Priorität für Jazmawi. Das ist einer der Gründe, warum sie Recorded Future um Unterstützung gebeten haben.
“With Recorded Future, we can mitigate cybersecurity risk, avoid unforeseen events, and take informed action in response to evolving threats faster and more efficiently,” Jazmawi said.
INVESTBANK quickly adopted the Recorded Future Intelligence Platform. The Platform indexes, structures, and analyzes data from the open web, dark web, technical feeds, and customer telemetry to automatically surface actionable insights.
Automatisierung von Sicherheitsworkflows mit Splunk
Improved orchestration is key for improving response times and reducing the lift of cybersecurity tasks. INVESTBANK used Recorded Future’s Splunk integration to significantly decrease the time spent on alert investigation and response — from a couple hours per day to a few minutes.
"Some activities require us to manually search the source of the connection, perform investigations, and reflect the outcomes on our security devices like firewalls. The integration with Splunk means all this is done seamlessly without any human intervention,” said Jazmawi.
Riyad Jazmawi
Chief Information Security Officer, INVESTBANK
The INVESTBANK team streamlines security operations workflows using pre-defined playbooks, creating seamless connections between tools and information.
“We use Recorded Future’s AI capabilities to make informed decisions when responding to evolving threats. The AI features accelerate our security operations and enable us to save time when generating reports or investigating events, allowing our analysts to interact with the platform in natural language."
Recorded Future korreliert und bereichert interne Daten mit externen Erkenntnissen, um die Identifizierung, Priorisierung und Behebung von Bedrohungen zu beschleunigen. Die Aufdeckung von Details über die wichtigsten Bedrohungen hat die Bemühungen des Informationssicherheitsteams erheblich beeinflusst. Nach dem Wechsel zu Recorded Future konnte das Team von Jazmawi seine mittlere Reaktionszeit (MTTR) um 80 % reduzieren.
Proactively understanding the threat landscape with Collective Insights
Every financial institution is vulnerable to cyber attacks, but there's strength in numbers. Recorded Future’s Collective InsightsⓇ allows INVESTBANK to consolidate detections and events from their security tools in a single dashboard, connecting threat data specific to their industry and region with data from within their organization. It enables the security team to correlate data and set priorities of action based on trends and patterns.
“Collective InsightsⓇ has made it possible to connect the dots between the big picture of what’s happening in the wild with what’s happening in our organization to holistically understand our threat landscape. This kind of visibility helps us protect our clients better, and enables transparency and trust between INVESTBANK and our clients," Jazmawi said.
These insights extend beyond just internal visibility. "Recorded Future allows us to share relevant data about threats targeting our organization with other institutes in Jordan and in our industry," Jazmawi added. This collaborative approach allows all financial institutions to strengthen their defenses.
Erkennung bösartiger Domain-Registrierungen in Echtzeit
Like many financial institutions, INVESTBANK is vulnerable to brand abuse and threat actors impersonating its executive team. The open-source data Jazmawi and his team used before Recorded Future didn’t provide reliable visibility into fraudulent domains or misuse of their brand assets. This lack of comprehensive information left the team in the dark about activity that could directly impact customers and damage their reputation.
The information security team started using Brand Intelligence, and now receive real-time notifications with detailed information regarding domains registered with a name similar to INVESTBANK. This information lets them identify malicious sites soon after they appear and issue a takedown request often before customers have a chance to interact, jeopardizing INVESTBANK’s reputation.
"Recorded Future protects our integrity and reputation by continuously monitoring the dark web for threats targeting our brand, our clients, or our top management," Jazmawi said. "We generate Watch Lists and automate Alerts to immediately address threats like social engineering, card fraud, and data leakage."
Riyad Jazmawi
Chief Information Security Officer, INVESTBANK
Getting proactive visibility into zero-day attacks
As Jazmawi’s team becomes more informed, they’re also becoming more proactive. The next step for the information security team was to gain visibility into potential weaknesses and prompt notifications about zero-day exploits.
Eine der größten Herausforderungen in einem schnelllebigen Unternehmen mit vielen digitalen Diensten besteht darin, das Bewusstsein für Sicherheitslücken kontinuierlich neben neuen Updates und Versionen aufrechtzuerhalten. INVESTBANK verlässt sich auf Vulnerability Intelligence von Recorded Future, um diese Herausforderung in eine Chance zu verwandeln.
Riyad Jazmawi
Chief Information Security Officer, INVESTBANK
Recorded Future provides Alerts and context on vulnerabilities not yet widely known to the public so the INVESTBANK team can take action to secure their digital assets and protect the organization’s reputation. They also gain insights into threat actors' intentions and techniques so they can adapt quickly and fortify their defenses going forward.
Using Vulnerability Intelligence also reduces time spent reviewing and taking action against new zero-day and critical vulnerabilities, saving up to two hours a day.
“Quality data and visibility at the sector level enabled us to emphasize and enhance the collaboration with other companies in the same sector in Jordan,” Jazmawi said.
Looking ahead, INVESTBANK plans to focus on advancing AI workflows to stay ahead of evolving threats.
A collaborative partner who supports a strong cybersecurity strategy
Die INVESTBANK legt in allen ihren Kundenbeziehungen Wert auf Partnerschaft und erwartet von ihren Anbietern das gleiche Maß an Zusammenarbeit und Unterstützung, das sie ihren Kunden bieten. Recorded Future hat sich als echter Partner erwiesen, indem das Unternehmen die Sicherheit der Kunden priorisiert und INVESTBANK dabei unterstützt, seine Abwehrmaßnahmen zu stärken.
The partnership also empowers the security team to quantify their impact for executive leadership. "We have KPIs based on data we obtain from Recorded Future and present these to the board of directors on a quarterly basis," Jazmawi noted. "This helps the business perceive the true value of threat intelligence and how it supports achieving our business objectives.”
Without Recorded Future, Jazmawi sums up that life “would be a lot harder.” INVESTBANK would lose valuable insights and predictions that have allowed the bank to be proactive in their cyber resiliency journey.
As INVESTBANK continues to place stronger safeguards around sensitive information, their clients can better trust their data is safe and can bank with even more confidence.