Protecting Critical Infrastructure From Ransomware with LogRhythm NDR – Source: securityboulevard.com

A European-based organization in the transportation industry needed a way to protect its data with a solution that could mitigate sophisticated threats and move beyond basic threat detection capabilities. It required a holistic solution that could continuously monitor and analyze network traffic to identify anomalous or suspicious traffic patterns.

Due to the critical nature of its business, it could not afford to take risks with its network security. It needed an effective solution that could allow it to safely secure its mission critical data with greater visibility and allow it to rapidly uncover suspicious activity.

The transportation provider chose LogRhythm NDR to identify and surface both known and unknown threats that cross both east-west and north-south network traffic.

The Challenge

Transportation services are essential to move people and goods across the world every day. Unfortunately, this sector constantly faces cyberthreats. Ransomware is a leading concern for organizations that provide critical infrastructure. A successful attack could mean disrupting critical operations or risking the health and safety of civilians. With so much at stake, our transportation customer recognized the importance of strengthening its cybersecurity posture to protect against a wide variety of threats.

The transportation provider had already deployed LogRhythm SIEM with additional threat intelligence and endpoint detection and response (EDR) capabilities. Despite already having threat protection and mitigation capabilities, it needed a better way to remove existing visibility gaps between its other tools to enable quick responses to emerging threats.

The transportation provider required a comprehensive solution to protect against network-borne threats. To overcome hidden security risks, a network detection and response (NDR) platform was the answer to help detect advanced attacks that evade perimeter tools.

Read Case Study

The Solution 

The transportation provider chose LogRhythm NDR to remove visibility gaps from its threat detection activities. LogRhythm NDR is an advanced security solution for obtaining a true representation of network traffic within the enterprise domain.

Upon deploying the solution, LogRhythm NDR alerted the transportation provider to anomalous connection data by a single user as potentially malicious activity and raised an incident. From that investigation, it identified device connections to a CC node related to BazarBackdoor, Trickbot, and Conti ransomware. These types of ransomware use multiple modules for various malicious activities, including information stealing, password stealing, infiltrating Windows domains, initial access to networks, and malware delivery.

This anomalous connection data was not highlighted by any of the provider’s other tools, including their next-generation threat intelligence platform, as the control node was so new it had not yet appeared on intelligence reports.

By leveraging LogRhythm NDR, the transportation provider was able to detect the malware “calling home,” giving the team the ability to respond before a serious breach occurred. The transportation provider achieved this by analyzing the meta data that was generated from the network traffic. The incident triggered based on the solution’s hybrid analytics that combine machine learning (ML), rules-based detection, and threat intelligence to analyze network, user, and host activity. This enabled the transportation provider to limit the amount of damage caused by malicious compromises and focus on delivering its services to customers without disruption.

The transportation provider benefitted from a comprehensive solution that surfaces the most pertinent threats to investigate. Through LogRhythm NDR’s intuitive capabilities for recognizing suspicious behavior, the organization was able to rapidly take action against threats and protect its critical data with confidence.

Protecting Data with Automation, Integration, and Intelligence

LogRhythm NDR provides our transportation customer with a scalable solution that uses automation, algorithms, and workflows to identify suspicious behavior for analysts to easily disable and block attacks. By combining both rules-based detection and ML-driven detection techniques, LogRhythm NDR helps identify suspicious behavior and monitor the network in real time, while easily integrating with LogRhythm SIEM. LogRhythm SIEM combined with LogRhythm NDR delivers a single pane of glass into network traffic and enables security orchestration, automation, and response (SOAR) capabilities from network data.

With LogRhythm NDR, the transportation provider


was able to build on its existing security foundations with EDR and SIEM. Whilst EDR focuses on monitoring and preventing endpoint attacks, NDR helps remove any existing visibility gaps, further protecting the environment. EDR focuses on a ground-level view of the processes running on a host and interactions between them, while NDR monitors and analyzes network traffic across users and hosts and is able to track activity on agentless endpoints. When integrating an EDR solution with NDR, you add enrichment to your NDR solution that enables NDR to become smarter.

“Not only does LogRhythm NDR ease the burden on our security teams, but it is also providing our security operations center (SOC) with the tools to automatically detect and alert to any suspicious behaviors,” said the organization’s security operations analyst. “The solution has already proved its effectiveness in detection and protecting our organization against ransomware. We can now focus on delivering our essential services to our customers with complete visibility into our network environment.”

Request more information

The post Protecting Critical Infrastructure From Ransomware with LogRhythm NDR appeared first on LogRhythm.

*** This is a Security Bloggers Network syndicated blog from LogRhythm authored by Ianni Le. Read the original post at: https://logrhythm.com/case-studies/protecting-critical-infrastructure-from-ransomware-with-logrhythm-ndr/