CyberArk

While digitization is increasing efficiency and significantly growing customer engagement, it also comes with several challenges, not least being the growing risk of cyberattacks.This led the company’s Australian, Pacific and Indonesian operations (CCEP API) to create a three-year roadmap for developing and implementing enhanced security measures. A key element of the plan has been to improve existing privileged access management processes and gain heightened oversight and control over the use of elevated credentials.

Capcom, a leading worldwide developer, publisher, and distributor of interactive entertainment, faced a significant challenge in improving its security measures. The company's game business, known for its advanced technological development capabilities, develops its own game engine based on fundamental technology. This proprietary technology approach has positioned Capcom as a leader in the game industry. However, the game development department handles vital data assets using a dedicated development environment for each project, which necessitates stringent security measures and compliance with laws and regulations of each country and region. Capcom had been focusing on strengthening security measures, but to work on more advanced measures and higher levels of protection, a dedicated Development Security Task Force was established. The task force began studying the introduction of technologies and mechanisms to protect valuable information assets.

The Court of Justice of the State of Amapá, a judicial body in Brazil, was faced with the challenge of updating and streamlining its justice system in the face of unpredictable, complex, and urgent cybersecurity threats. The Brazilian Superior Court of Justice had previously been a target of a ransomware attack, which halted operations for a week and affected up to 12,000 pending lawsuits. In response to these threats, Brazil’s National Council of Justice launched ‘Justice 4.0,’ a package of reforms designed to modernize the justice system by adopting technology to improve access, transparency, and speed. This required each state judiciary to implement an identity security and management system. The Court of Justice, Amapá, needed to boost its safety procedures, particularly Identity Security, to meet these compliance demands and to better match larger business and market trends. The shift to remote work during the COVID-19 pandemic further highlighted the need for a strong identity management solution.

Gamania Group, a Taiwanese conglomerate with businesses in online gaming, e-commerce, e-payment services, and IT, was facing a significant cybersecurity challenge. With over 10 million registered members worldwide, the group was a prime target for hackers and ransomware attacks. The group's flagship business, Gamania, a mobile games publisher, was particularly vulnerable due to the nature of its operations. The company manages one of the world's most famous massive multiplayer online role-playing games, MapleStory, which attracts a diverse range of participants, including malicious individuals intent on causing damage or seeking to extract money from the business and its customers. Other businesses in the group, such as the GASH Mall online payment system and GAMA PAY payment-payment service, were also prime targets for cyberattacks. Aware of the high-level threat it faced, Gamania Group set out to build a modern and robust cybersecurity defense strategy.

Federated Insurance, a national insurance business based in Owatonna, Minnesota, was facing challenges in managing cybersecurity risks, particularly in the area of privileged access management and identity protection. The company was aware of the growing threat of cyberattacks, especially for organizations in the financial sector. A few years ago, the company reviewed its cybersecurity capability and realized that it could be improved. The company found that most passwords were written down somewhere or linked to user IDs, which posed a significant security risk. The company wanted to make privileged accounts easier to manage so people did not have to keep remembering long passwords or write them down. Additionally, the company was aware that regulations and insurance standards around cybersecurity were getting tougher, so it needed more robust privileged access and identity protection.

Garanti BBVA, Turkey’s second-largest private bank, faced a significant challenge in securing its privileged accounts and identities used in its DevOps and cloud environments. With a broad attack surface due to its extensive business lines and 18,000 employees, the bank needed to protect against the theft of privileged credentials. The bank also had to ensure compliance with stringent data security regulations within both the Turkish and global financial sectors. As one of the pioneers of internet banking in Turkey, Garanti BBVA was pushing forward its digital transformation journey, which increased its in-house development operations (DevOps) to improve application and service delivery. This transformation resulted in a need for more robust security tools.

Healthfirst, the largest not-for-profit health insurer in New York State, faced a significant challenge in evolving its cybersecurity operations. With a rapidly growing member base of 1.8 million and an increasingly complex healthcare landscape, the organization needed a robust cybersecurity program. Healthfirst holds a comprehensive database of member-related information, including enrollment, billing, customer care, payments, processing claims, and health data. The protection of these highly sensitive healthcare records and identities of members and staff was paramount. The organization had adopted a cloud-first strategy, with approximately 70% of systems and applications now cloud-based and 10,000 endpoints, 70% of which are remote. This required a sophisticated and robust security solution. The organization aimed to transform the industry by digitally enabling its members, which included heavy investment in digital apps, virtual community-based offices, and mobile solutions.

Kainos, a UK-based digital technology company, faced a significant challenge in securing sensitive data across its global workforce. With over 3,000 employees in 22 countries, the company had to ensure secure remote work and client location operations. The company's employees had the freedom to choose, download, and install applications, which, while convenient, posed a security risk. An audit revealed that there were 50,000 different applications in use globally. The company also faced constant threats like phishing, fake Office 365 password reset scams, and LinkedIn targeting for new starters. The challenge was to enhance security without hindering the work of different user groups, including developers, business staff, and senior executives, who required varying access rights.

Maximus, a global government services company, was in the process of implementing a digital transformation strategy to improve program efficiency, work smarter, and drive productivity and quality. A key part of this strategy was the transition to a cloud-first enterprise through the migration of key systems and applications to the cloud. This change provided an opportunity to rethink and strengthen the company's approach to privileged access management (PAM) across the organization. However, the existing PAM solution that had been selected for Maximus' legacy environment required a lot of customization, had limited integration capabilities, and could not handle complex use cases. The challenge was to create widespread improvements across the $3.4 billion corporation with only a modest-sized team and limited resources.

o9 Solutions, a leading AI-powered planning, analytics and data platform provider, faced a significant challenge in ensuring the security of its Fortune 500 customers' data. The company delivers its services via a multi-tenant cloud environment based on AWS, Azure and Google, making identity protection and management crucial to access control. However, as cyber threats became more widespread and sophisticated, the visibility of identity and threats became poor and disconnected. There was no centralized way to monitor and control the various cloud environments the company used. The company needed to develop a more robust and effective Privileged Access Management (PAM) capability to match or exceed the cybersecurity and corporate governance strategies of its large, global customers. The customers needed reassurance about how o9 Solutions managed and controlled access to their data and the environment.

Pacific Dental Services (PDS), a leading dental support organization, was faced with the challenge of managing and controlling a large number of privileged accounts, passwords, and mobile devices across its geographically dispersed teams. The company supports over 900 dental practices and is responsible for protecting the personal and sensitive healthcare information of dentists and their patients across the U.S. PDS team members had access to approximately 20,000 clinical service websites, and passwords for these sites were recorded on an intranet-hosted spreadsheet, leading to security issues and chaos. Additionally, PDS manages over 5,000 laptops and mobile devices for team members based at their National Support Offices and a good number of remote/mobile team members. Admin rights were being granted, often for basic things like installing a web camera or updating a driver. However, these admin accounts would stay with the device, sometimes for years, posing a security risk. PDS needed a better way to monitor and manage user access across this environment.

A leading European bank, serving over ten million customers, was looking to enhance its digital banking services with Kubernetes and cloud-native computing environments. However, with the increased digitization of services, security became a paramount concern for the bank’s stakeholders and clients. As the bank initiated its journey to the cloud, it adopted a variety of cloud-based technologies to rapidly address and respond to new business needs, such as providing customers with secure home banking services and secure apps for mobile phones. The bank realized that adopting cloud and related open-source technologies came with a price in terms of management and security constraints. One of the most critical aspects of the cloud journey was how to properly manage identities and secrets (privileged credentials or grants) across different cloud services. Managing secrets across different cloud and hybrid services are typically a pain point in every organization’s cloud journey.

Svensk Travsport, the governing body for Swedish trotting, was facing a high number of cyberattacks on its sensitive data. The data included information about races, transactions related to horses, rider and horse performance, history of wins, and horse pedigrees. This data was used by owners, trainers, and the public to make investment, training, and betting decisions, making it a prime target for cyberattacks. In addition to this, the organization had to comply with constantly changing regulations such as GDPR. The data also included information on staff and around 15,000 external members such as riders, owners, and breeders. The cybersecurity landscape was also changing, with a shift from on-premises to the cloud, requiring a different protection approach. The organization aimed to achieve a high level of assurance for data and stakeholder protection while making access to data and applications easy for users.

Tribunal Regional do Trabalho da 8ª Região (TRT8), a judiciary body in Northern Brazil, was facing a surge in cyber attacks, a situation that was particularly concerning given the sensitive nature of the data they handle. The organization had recently digitized its court case management system, making all information related to court procedures, including highly sensitive personal information about individuals involved in employment disputes, digital. Despite having a robust security strategy, TRT8 had little control over users and passwords with access to this information, and privileged access was decentralized. Enforcing security information policies such as regularly changing and updating passwords was a manual and time-consuming process. Endpoint protection relied on a basic anti-virus tool, leaving the organization vulnerable to viruses or malicious attacks that could disseminate throughout the network and harm court operations.

Turkcell, a leading digital operator in Turkey, faced a significant challenge in protecting its 40 million customers, 300,000 network devices, and 40,000 employee and partner identities across Turkey, Ukraine, Belarus, and Northern Cyprus. As the largest telco in Turkey, Turkcell offers a wide range of services, making cybersecurity a critical business operation. The company has won several awards for its digital security products and plays a key role in the Turkish cybersecurity industry. However, the company's aggressive digital transformation path, which includes new digital services such as instant messaging, TV and music platforms, personal cloud services, search engine, and email services, increased its attack space. The COVID-19 pandemic further complicated matters as most staff began to work remotely, potentially exposing Turkcell to new, unforeseen risks. A risk assessment initiative highlighted a potential vulnerability in Windows servers, prompting the company to seek a robust security solution.

To improve services, reduce costs, and increase business efficiency, a digital transformation initiative was launched that embraced a cloud-first, mobile-first strategy. Previously outsourced services were brought in-house, and most infrastructure was transferred to a multi-cloud environment using Microsoft Azure and AWS. As the IT team expanded from seven to over 140 employees, ensuring the security of this increasingly complex environment became a priority. A three-year strategic roadmap was put in place to focus on improving identity governance, administration, and privileged account management. The company needed a solution that went beyond traditional password vaults to address operational efficiency and end-user experience.

The organization was facing challenges in managing its privileged accounts in a complex and growing environment, especially as it moved into the cloud. Previously, the infrastructure management was chaotic, with sysadmins having excessive privileges and access to everything all the time. This lack of control and auditing posed significant security risks and inefficiencies.

Appen was using Active Directory as a central location for managing user access and privileges, but the process was manual and time-consuming. The inability to manage identities and privileges at scale was impacting every department, reducing their overall effectiveness and potentially impacting security. Appen needed an effective, secure, and easy way to automate access controls. Additionally, Appen's systems and processes are subject to regular audits to comply with customer and regulatory requirements, necessitating easier access to user data and the ability to securely manage user privileges across their environment.

One of Rockwell Automation’s most important IT priorities was to proactively identify the privileged access risk while ensuring that all accounts complied with regular but flexible password policies. With multiple employees, servers, privileged accounts and password policies established across their platforms, standardization and control would be imperative to ensuring that Rockwell identified and mitigated the risks associated with unmanaged privileged accounts. The company sought a solution to enforce and automate role-based privileged access control and policies in order to secure accounts, mitigate password vulnerabilities and support audit and compliance requirements such as those defined within Cobit’s DS5.4 User Account Management. Moreover, reflective of Rockwell’s process-oriented business, the company required detailed access to metrics that demonstrated the extent of privilege access vulnerabilities, including any risks associated with unmanaged accounts and administrative rights.

As a large communications services company, BT's infrastructure is complex and vast, spanning numerous business units and geographical regions. BT had several point solutions in place to manage privileged access and identities but found that these solutions were inconsistent and did not scale well to meet its requirements. Following a significant internal report, BT decided to improve its existing architecture and extend its security of privileged access to the enterprise. The company wanted a single solution, standardized across the global organization, that could be scaled up easily as required. This solution would complement BT's existing portfolio of managed security services, providing its rapidly expanding customer base with privileged access management to help them better meet compliance requirements.

CDW, a leading provider of technology solutions and services, faced challenges in managing and storing system passwords and user credentials to meet audit and compliance requirements. With a growing managed services business, CDW needed a solution to handle credentials for accessing remote systems at customer sites and systems under a hosting model. The manual process of generating and managing credentials was time-consuming and inefficient, requiring a more automated and secure approach.

As one of the largest telecommunications providers in France, Bouygues Telecom is entrusted with vast quantities of sensitive customer data and is conscious of its duty to protect this information. Prior to the deployment of CyberArk solutions, Bouygues Telecom had two custom-built in-house systems in place to manage their privileged accounts, including one repository through which the company stored and managed internal passwords. However, both custom-built systems were becoming outdated and would have been extremely costly to overhaul. Crucially, the existing models were also unable to deliver the level of security and scalability necessary to meet the company’s growing needs. As a result, Bouygues Telecom looked to vendor solutions in a bid to better secure and manage the large number of privileged credentials existing in the corporate network.

The information that is handled by Clearstream on a daily basis is extremely sensitive. In order to address security concerns surrounding this, Clearstream initially needed to automate its manual administrator password management process to control access to privileged accounts based on pre-defined security policies. As the connection and transfer of data was regularly password protected, Clearstream required a more mature, professional solution to manage and control its passwords to ensure that corporate and customer information was appropriately protected. Strong authentication, information integrity and encryption were also essential so that only the right people had access to the right information and that this access could be adequately tracked, logged and monitored. In order to satisfy auditors as regulations continue to evolve, Clearstream sought a forward thinking solution that offered a clear overview of administrator activity and that could facilitate secure storage of this information in logs. Due to auditors having to adhere to extremely strict and tight timelines, Clearstream needed a solution that could quickly and accurately deliver the information required. This is a constant regulatory requirement and Clearstream wanted to work with a technology partner that could continue to evolve with the company to meet these needs.

Financial services companies deal with highly sensitive information on a day-to-day basis, with customer and corporate data at the heart of routine operations. These businesses operate in not only one of the most competitive industries, but also one of the most tightly regulated sectors in the world. Rabobank prides itself on being a market-leader and as such not only adheres to industry regulations, but imposes strict security policies and procedures on itself to ensure watertight security across all of its operations. Following an internal review of its systems, Rabobank International, Rabobank Group’s wholesale banking and international retail banking division, saw a major opportunity to update and improve security procedures, as well as its operational efficiency, by replacing its existing manual process for managing passwords. Rabobank International sought a security solution that could remove the physical labour of managing highly privileged passwords manually, while simultaneously augmenting its operational efficiency – reducing costs and boosting productivity – and dramatically improving security standards.

As an IT service provider to the banking industry, IT security is a top priority for Fiducia. Fiducia continuously strives to enhance the protection it provides its customers and their data, and as such, turned its focus to privileged password and account management. With a highly complex, heterogeneous data center environment consisting of more than 10,000 UNIX and Windows servers, five IBM mainframes, some 400 databases and 1,500 network components, Fiducia had more than 20,000 privileged accounts that needed to be secured and managed. Previously, Fiducia employees managed all of these privileged accounts and identities manually. To reduce the time and effort and risk involved in managing privileged accounts, Fiducia decided to introduce an automated password management system. The system needed to be easy to implement and integrate with the existing complex system environment while offering high reliability and absolute data security. Requirements included a secure central password repository, 24/7 application availability, access to stored passwords in a disaster scenario, logical and physical access protection, end-to-end monitoring, full traceability of all activities and rapid recovery in an emergency.

National Gypsum faced significant security and compliance challenges due to the lack of management and monitoring of privileged accounts. The company used a single 'domain admin' level account across all applications and servers, with poorly documented and infrequently changed passwords. This created substantial database vulnerabilities and compliance weaknesses. The CFO and controller demanded that IT pass audits related to access control, but the existing setup posed a high risk of security breaches. Recovery from a serious security compromise could be devastating, as changing compromised account passwords would break the systems where they were embedded.

Finansbank faced daunting IT security and compliance challenges associated with its highly manual, time-consuming approach to managing privileged passwords to its core banking systems. There was one dedicated password for each server and each device in the network. All passwords were stored in approximately 200 separate paper envelopes in a physical vault. If anyone needed access to an application, server, or necessary system, password requests were processed through a service center and issued by hand by the IT team. If there was ever a server crash or the need for a password to be accessed immediately, as in a break-glass scenario, it could take more than 30 minutes just to get the right envelope. Additionally, password inventory was stored in an Excel file, audit reports were limited, and the process for manually resetting passwords after each use wasn’t efficient. The manually-intensive approach to password management was impeding the bank’s ability to scale operationally, it was difficult to manage power users, and meeting audit and compliance requirements put a serious strain on resources.

As one of the largest pediatric medical centers in the United States, Boston Children’s Hospital offers a complete range of health care services for children from birth through 21 years of age. To support this world-class medical center, the hospital’s IT department has created state-of-the-art work and patient care environments to support the evolution and practice of the world’s most advanced and compassionate pediatric care, most sophisticated research, and high-level teaching and training. Like many large organizations, Boston Children’s Hospital needed to find a way to automatically administer and protect the most powerful identities in the company – the privileged accounts and administrator passwords. They allow access to a wealth of sensitive data and powerful systems within the hospital and must be managed very carefully. Sharing administrator privileges or allowing people to jot down passwords on sticky notes was simply unacceptable. The hospital wanted a way to not only protect the identities against unauthorized use, but streamline the process of issuing and revoking special privileges and rights. Previously, it was difficult to keep track of not only who had been issued a privileged password, but it was impossible to determine who was using them, when and what they were accessing. In an IT environment involving children’s patient information, it was critical to be able to have greater visibility into the use of powerful system accounts.

With $21.4 billion in annual sales, AstraZeneca is one of the top five pharmaceutical and health care services providers in the world. The pharmaceutical industry is highly competitive and regulated. In 2004, AstraZeneca invested $3.8 billion into new drug research and development, employing 11,900 people dedicated to this task. The company needed a secure and manageable way to collaborate internally and with external partners. Previously, AstraZeneca used an in-house secure collaborative application requiring a VPN client on each user’s system, which proved to be a high-management burden. Frequent help-desk calls and firewall adjustments were common issues. AstraZeneca needed a seamless, web-based solution with no setup overhead or firewall concerns.

Members of McKesson’s legal department need to frequently exchange sensitive documents that contain financial data, intellectual property, and information about pending lawsuits. The information within these documents is typically highly sensitive and regulated. As such, the legal team needs to be sure that their documents are safe from unauthorized access and securely stored in a way that is compliant with industry regulations and standards. When the legal team began searching for a file sharing and storage solution, they required a system that would protect their most sensitive information from unauthorized access and that would meet compliance guidelines out-of-the-box. Specifically, the team needed a solution that offered granular access controls and enabled administrators to audit access to files without having access to the files themselves. After evaluating the options available, the legal team selected the CyberArk Sensitive Information Management Solution.

FS moved its data center off-premise to the cloud, so there was an opportunity to strategically build the security infrastructure up front to manage more than 300 machines on AWS. Each of the servers has its own SSH key and a local user for development. Multiple people need to connect to the servers all the time. Managing the security of these privileged accounts was a complex and complicated endeavor. Also, the company wanted to have a system in place to track all changes to ensure each was approved for deployment and documented for long term analysis and audit. Having proactive security measures in place to mitigate risks associated with privileged accounts was not only important to the IT team supporting a growing business, but it was also a priority for the CEO who understands the business benefits of protecting digital assets.

Protecting the privacy and security of data is a top priority. The company’s highly diverse IT environment runs multiple Windows platforms, and more than 85% of end users had administrative rights to their machines which was a security risk. To reduce the attack surface, the company was compelled to rewrite IT security policies in support of removing administrative rights from business users on endpoints. Ultimately, the goal was to implement the new IT security policies with the least disruption to and resistance from end users, while doing so in the most cost effective way possible. Due to the company’s IT environment and the applications supported, it was critical to have the ability to define a specific application to run with elevated rights without having to give the same rights to child processes.

One of Canada’s leading institutional fund managers faced significant risks from potential insider threats. With over $200 billion in assets, the company needed to protect against both external and internal cyber attacks. The primary concern was the abuse of privileged accounts, which could allow malicious insiders to move freely and undetected within the network. The company had hundreds or thousands of privileged accounts that were unknown, unmanaged, or unsecured, posing a critical vulnerability. The challenge was to identify and secure all privileged accounts to mitigate the risk of insider threats.

For this global communications company, Pass-the-Hash attacks posed an immediate and troubling challenge. While the company was able to identify the existence of these types of attacks before a serious breach occurred (evidence of password theft and password cracking was clear and eminent), they struggled with the unique nature of a stolen hash. As a first step, the IT team opted to restrict access to their admin and privileged accounts by issuing Smart Cards. Unfortunately, this did not solve the problem, as vulnerabilities persisted within these Smart Card-enabled accounts. Smart Cards, which are touted to prevent credential theft through multifactor authentication, actually exacerbate the problem. With Smart Cards, the passwords associated with each privileged account, by default, never expire and are never changed again. As a result, once the hash is stolen, the attacker can exploit it in perpetuity. To truly combat Pass-the-Hash attacks against Smart Card-enabled admin accounts, the organization would need to deploy a custom solution that ensures admin and privileged passwords are automatically changed with some frequency to proactively protect against stolen credentials and abuse.

The airline has a robust e-commerce application, allowing travelers to search and book flights directly from the corporate website. This airline website was ranked the fifth largest travel site and the largest airline site in terms of unique visitors (source: Comscore MediaMetrix). As a result of its online growth, the airline was acutely aware of the need to maintain compliance with the credit card data protection standards mandated by the Payment Card Industry (PCI) Security Standards Council in its efforts to ensure credit card security. The PCI Data Security Standard (DSS) industry protocol is a common set of tools and measurements that are applicable across industries to help ensure the safe handling of sensitive credit card data and the protection of cardholder information. PCI Compliance in travel and tourism is often differentiated from other industries because of the lag time between when a flight is booked and when the credit card is processed for that booking. In this scenario, the credit card information is usually stored until the travel has actually taken place, or shortly before. This practice is not allowed in a PCI compliant environment, leaving travel companies at risk for fines and under intense pressure for ensuring their databases are protected from being wrongly accessed or altered - unintentionally or otherwise. As a result of these requirements and increased exposure due to its popular e-commerce business, the airline needed a new approach to document the steps it was taking to achieve PCI compliance with auditors. In this case, that meant proving that passwords to its database of sensitive customer data (including names, credit card numbers, billing addresses and other information) were being effectively monitored, managed and changed regularly.

As an investment firm, this company is required to generate and send 1099 tax forms to its American clients each year. These forms are used to report additional earned income, including that from investments and interest payments. Since many of this firm’s clients hire Certified Public Accountants (CPAs) to prepare their taxes, these forms must first be shared by the firm with its clients and then by the clients with their CPAs. A key challenge the firm has faced is that these 1099 forms, which contain sensitive personal and financial data, must be handled with the highest degree of security. In the past, once these forms were generated in January each year, the firm would mail the forms to its clients since electronic means of file sharing were considered too risky and insecure. Clients, in turn, would mail or physically deliver these forms to their external CPAs. This highly manual process was costly and inefficient for both the firm and its clients. The firm’s IT team began searching for an easier, more secure way to send these sensitive tax documents to their clients and to enable their clients to share these tax documents with their external CPAs.

CyberArk works primarily with this financial services company’s business banking segment, which provides a number of financial products and services including business checking accounts, payroll management, accounts receivable processing and accounts payable processing. Before digital transfer and storage technology was available, many of the banking and treasury management services provided to customers were highly manual, requiring significant time and physical resources. This approach restricted the company’s ability to scale its business and create new competitive advantages. In order to expand its service offerings while still addressing the increasingly complex compliance and operations requirements, this financial services company needed a more secure, automated and operationally efficient approach to handling Cash Letter processing, Account Reconcilement Processes (ARP), Automated Clearing House (ACH) transactions, and Lock-box files. At a minimum, this would require transforming these files into digital assets that could be securely transferred, processed and stored. At the time, in the early 2000s, exchanging digital files was a challenge that required companies to develop in-house expertise around technologies such as File Transfer Protocol (FTP) and/or invest in expensive solutions that small to mid-size corporate customers couldn’t always justify. Even with the in-house expertise and expensive systems, many businesses couldn’t guarantee the security of electronically transferred files, nor could they guarantee that the system management processes would be governed properly. This company turned to CyberArk to help eliminate the need for complex, expensive and time-consuming communications technologies and instead move towards a more secure, automated solution.

Due to the nature of the practice, it is of the utmost importance that the law firm’s most sensitive information be handled with only the highest degree of security. One the firm’s biggest challenges was that executives and external board members considered electronic communications too risky to use to transmit confidential information for board meetings. As a result, the executives and board members still relied on the physical distribution of paper and CDs. The process of using paper and CDs was overly cumbersome, prone to error and highly ineffective for sharing important information quickly. Additionally, the distribution of paper and CDs was a largely untrackable process, and there was a significant risk that these items could accidentally fall into the wrong hands. Jamie, the Manager of Information Security, recognized the many challenges and risks associated with the use of papers and CDs. As a result, he began to search for a highly secure solution that could safely enable the exchange of confidential information, offered granular access control and was able to track exactly who accessed what and when.

As cloud vendors including AWS and Azure make clear, security in the cloud is a shared responsibility. Though these public cloud vendors take great efforts to secure the cloud infrastructure — compute, storage, etc. — their customers are fully responsible for protecting everything above the hypervisor, including the operating system, applications, data, access to external resources and other assets and infrastructure. Fully appreciating this shared responsibility model, the TOTVS Cloud security team set out to identify a security solution that could not only bolster their cyber resilience but also add value to the TOTVS Cloud by driving automation, standardization and increased efficiency. TOTVS Information Security Cloud Team conducted an in-depth technical analysis of potential solutions, ultimately selecting and deploying the market-leading CyberArk Privileged Access Manager Solution based on overall performance, resilience, health checks, high availability/disaster recovery requirements and cost.

According to the 2018 Deloitte Global RPA Survey, 53 percent of organizations have already started their RPA journey to help robotize repetitive routine tasks and drive digital transformation. RPA adoption is expected to increase to 72 percent in the next two years, and if it continues at its current level, RPA will have achieved near-universal adoption within the next five years. It’s not hard to see why – the same study points to total ROI in less than 12 months, with significantly improved compliance, quality, accuracy, productivity and cost reduction. This global insurance provider has embarked on a multi-year digital transformation journey aimed at achieving agile development at scale. To help steer this strategic initiative, the company’s application development team has embraced Blue Prism’s RPA technologies to automate operational activities, test new applications and accelerate operational agility. Over the past 12 months as part of a proof of concept, the firm integrated 10 business critical applications – including SAP, Windows and Lightweight Directory Access Protocol (LDAP) – into the Blue Prism Digital Workforce Platform. To interact directly with business applications, RPA software must mimic the way applications use and mirror human credentials and entitlements. This can introduce significant risk when the software robots automate and perform business processes – whether logging into a system to access data or moving a process from one step to the next. Often times, the credentials being used are hardcoded directly within the application. If an attacker successfully steals these credentials, they can ultimately take full control over the robot and gain access to target critical systems, applications and data. Fully understanding these risks, the CVP of Privileged Access Management at the firm, made securing privileged access to these robotic credentials a top priority.

Despite its success, like all enterprises BRAC Bank Limited (BBL) must face up to the many and varied challenges of security. To do this it has taken bold steps, becoming the first (and so far only) local bank to achieve ISO 27001:2013 certification for security management and BBL was the first Bangladeshi bank to deploy a Security Operations Centre to anticipate and defend against threats. Participating in the highly regulated financial sector, the bank prides itself on being at the forefront of implementing state-of-the-art security controls, policies and procedures across all operations. However, BRAC Bank must still address the familiar malware, spoofing and other familiar threat vectors. Also, it recognises that the cybersecurity threat landscape continues to change as data governance rules are adapted over time, including the Bangladeshi Guideline on ICT Security for Banks, PCI-DSS and SWIFT, while addressing payment partners’ security requirements and other local regulations. And, again typical, the bank has to fight to justify access to IT security resources and to retain security staff in a world where these skills are highly prized.

According to the 2017 Verizon Data Breach Investigative Report, 81 percent of data breaches involve weak or stolen credentials. Understanding that many cyber attackers focus their efforts on harvesting privileged credentials, the real estate services company has trusted CyberArk for more than six years to protect, control and monitor privileged access to critical information—including 500+ systems and one of its primary data centers. In the past three years, the organization has accelerated its move to the cloud to improve efficiencies, scale processes, deliver enhanced client services and maintain its edge in the ultra-competitive real estate market. Despite its many benefits, the cloud’s multiplier effect has created exponentially more privileged account credentials and secrets that are highly targeted by attackers and need to be properly managed and protected. As part of their cloud journey, the organization’s security team sought a way to further enhance security around these powerful, privileged account credentials through an additional, complementary security layer: multi-factor authentication (MFA).

Growing both organically and through acquisition since 1865, Milliken amassed unprecedented intellectual property, which has powered much of the company’s success. It has also presented challenges to protect that information and mitigate risks presented by the modern IT environment. Privacy and data security were a top priority. With the company operating more than 50 locations around the world, they needed a solution that could cover every endpoint and scale with the growing company. Amidst a current landscape of large breaches occurring at other companies, Milliken’s desire to protect its associates and its intellectual property led them to perform an internal security assessment, which included hiring a third-party security consultant to independently evaluate their environment. The assessment’s outcome demonstrated to the Milliken security team that changes were needed, leading to new security policies for managing this global IT environment. At Milliken, end users were running with full administrative rights on their company devices. A goal was established to eliminate this high risk and only allow certain individuals to have elevated privileges and only for specific applications and functionality. Along with establishing least privilege, the company sought better capabilities to govern application control. To ensure that users continued to have the freedom needed to do their jobs effectively, the right solution needed to balance the needs of the business around innovation but also minimize risk to the company and brand.

This global financial services firm, with $2 trillion in assets and operations in more than 60 countries, faced significant challenges in managing nearly 50,000 emergency or break-glass accounts. These accounts are essential for emergency access to over 20 target platforms across seven lines of business. The firm's Security and Risk Management Group was under immense pressure due to the manual and burdensome processes required to manage these accounts. The complexity was further exacerbated by the use of three large, regional Lotus Notes databases for managing break-glass accounts, which contributed to extended password request and fulfillment times. The primary goals for investing in a privileged identity management solution were to reduce costs through better automation, migrate from the slow and complex Notes technology, and centralize the databases.

The direct selling industry, which collects billions of personal data points from customers globally, is a prime target for cybercriminals. Beyond personally identifiable information (PII) and payment card industry (PCI) data, they gather other sensitive information such as social security and government ID numbers. Princess House’s information systems and technology (ISIT) team recognized the need to secure privileged access to this sensitive information to preserve customer trust and protect Princess House’s reputation. Before implementing a PAM solution, accounts were stored in password-protected spreadsheets without enforced password rotation, posing a significant security risk. The team initially selected a PAM solution but faced issues with its implementation, which was complicated and lacked a step-by-step guide. The platform was inflexible, requiring all accounts to be managed at once, which was not suitable for their phased approach.

Changing customer expectations, greater digital use, and the evolving cyber threat landscape are challenging financial institutions to balance innovation with effective security practices. Privileged access management (PAM) is critical to enable flexible yet controlled access to critical systems holding sensitive customer PII and other valuable information. As financial systems grow in size and complexity, privilege is everywhere, making strong PAM essential for banks to move with agility without jeopardizing their brand or regulatory compliance.

To enhance global collaboration and integration, Shiseido planned to move to an entire portfolio of cloud-based applications but needed a single sign-on capability to provide robust user authentication for both Active Directory and external users. Shiseido’s legacy environment utilized an on-premise application, accessible via a domestic portal for its Microsoft Windows-based users. The company recognized that it would be impractical for the existing corporate infrastructure to support new cloud applications because it would force users to set up individual IDs and passwords for each application that needed to be accessed. Worse still, it would significantly increase the security risk with so many different passwords having to be created and memorized. In addition, the company estimated there would be a significant reduction in user productivity associated with managing the numerous log-ins, and an associated increase in IT support and administrative work to keep everything running smoothly. Leveraging the portal concept, Shiseido’s plan called for implementing an Infrastructure-as-a-Service (IaaS) environment but to be successful, there was an urgent need for an authentication infrastructure that could enable single sign-on access to cloud-based applications via a globally available portal.

The insurance company wanted to use DevOps methodologies and containerize thousands of applications to increase business agility, eliminate inefficiencies, and accelerate the pace of innovation. Containerized applications use secrets such as passwords, tokens, and SSH keys to gain access to sensitive enterprise resources such as databases, web applications, compute, storage, and networking services. The security team recognized that in some other organizations, out of expediency, developers have hardcoded secrets, access keys, and other sensitive credentials into applications. Hardcoded credentials are not only challenging to rotate but also potentially expose the business to data theft and malicious attacks. The insurer’s information security organization wanted to ensure credentials were removed from code to reduce potential vulnerabilities, such as inadvertently exposing secrets in the code stored on repositories. A key priority was to ensure applications can securely access databases and other sensitive resources without impairing developer productivity or hindering application delivery.

The company faced challenges with their existing SharePoint workflows and DevOps processes, which were frequently breaking. They needed a more reliable and efficient way to manage privileged access without the need for submitting tickets, going through workflows, or waiting for approvals. Additionally, they had a tight deadline to meet an external customer requirement for privileged access management, which included signing the purchase order, installing the solution, and managing a larger number of servers than initially anticipated.

The organization faced significant risks related to endpoint security, particularly concerning the potential for pass-the-hash attacks and same-account harvesting. The challenge was to reduce the attack surface by removing local administrative rights on workstations, which would minimize the chance of privilege escalation. Additionally, the organization needed a solution that could provide immediate reporting to the Security Operations Center (SOC) in case of an incident. The goal was to enhance overall security while maintaining operational efficiency.

Implement a cloud-based identity management solution as the basis for an entirely new cloud-based infrastructure. Include secure single sign-on (SSO) to support productivity-enhancing mobile apps. Do this in a way that reduces demand on IT. As with any Local Distribution Company (LDC), the top priority at London Hydro is literally keeping the lights on. LDCs must therefore act with extreme caution when it comes to introducing new technologies into the system that could negatively impact service to customers. But that caution must be balanced with the many benefits new technologies provide, such as the ability to significantly reduce costs, improve delivery systems and minimize waste. After months of careful evaluation of the advantages and the risks, Mike Flegel, Cyber Security Specialist at London Hydro, was tasked with finding a single sign-on platform that would support the company’s move to a cloud based infrastructure. Historically, security at LDCs has been a matter of simply keeping office and field networks physically separate, and requiring multiple passwords to access individual resources. But times have changed — complete separation can be too restrictive and users juggling multiple passwords can end up being security risks themselves. London Hydro needed to implement an identity management solution that would be the basis for an entirely new cloud-based infrastructure consisting of everything from traditional ERP datacenter applications like SAP and JDE to new, mobile apps for the field. At the same time, it was important to reduce the IT workload by minimizing password reset requests, and simplifying the process of adding or removing employee access and incorporating new apps into the environment.

Avoid the build-out of a high-cost disaster recovery co-location for a product that was already difficult to implement and manage. Simplify app integration, address MDM requirements and SOX compliance, and ensure a more robust security stature. When SBA Communications began using SaaS-based apps like Innotas, ExpenseWatch and Yammer, they implemented Microsoft’s Active Directory Federation Service (AD FS) at an approximate total cost of $35,000 for identity management. While implementation and application integration proved challenging, the product met the company’s requirements at the time. As their environment evolved, however, the solution became increasingly difficult to manage. To assist in the implementation, they hired a consulting firm with AD FS expertise, which took six weeks to get the initial solution implemented. However, a new version of AD FS was soon released, and the company was faced with having to migrate the entire infrastructure. Integration was so painful the first time around that they dreaded having to migrate those same apps into the new environment. The unfortunate result was two live versions of AD FS, each with its own set of SaaS applications that required significant resources and a coordinated effort to maintain. The real issue arose as cloud-based solutions became more pervasive within the company’s environment. While they had previously incorporated only a few, less-critical SaaS apps, the benefits of cloud-based solutions led the company to adopt more until eventually disaster recovery became an issue.

At Chugai Pharmaceutical Co Ltd, three different tools were used to provide single sign-on (SSO), enterprise mobility management (EMM) and multifactor authentication (MFA) across the company’s European and US divisions — Chugai Pharma Europe, Ltd. With a limited IT staff in each location, management of these separate solutions created unnecessary strain and considerable expense. Looking to simplify IT processes and save money, the company first considered expanding its relationship with its existing SSO provider. The company was also looking to replace its existing MFA tool with a solution that leveraged users’ mobile devices. They needed a cloud-based solution that included SSO, MFA and EMM to protect Chugai’s intellectual property as well as the personal information of patients participating in their clinical trials.

Implement identity federation services for Office 365 without requiring significant new investment or added pressure on the IT team. Provide single sign-on for users. Simplify the IT tasks of user provisioning and deprovisioning. Help ensure compliance with GLBA regulations. In the process of renewing their Microsoft Enterprise Agreement, The Citizens Bank decided it was time to move to Office 365 for a more easily-managed solution. However, they’d heard that Microsoft’s complementary Active Directory Federation Services (AD FS) product comes with many challenges and considerable expense. The company decided to look for a more efficient solution that wouldn’t require significant additional investment in the transition to Office 365. As an FDIC-regulated financial institution, the company must also comply with GLBA (Gramm–Leach–Bliley Act) regulations, which require that a host of specific actions be taken to protect customer financial data. Two key components of protecting user information are tightly controlling access to the data and having the ability to quickly remove that access when employees leave the company. So, secure password management and the ability to easily provision and de-provision cloud applications are essential.

Drive flexibility across the business. Deliver employees single sign-on access to all the apps they need, located in one central portal. Ease the onboarding process and increase productivity for all users. When Chief Technology Officer Sébastien Huet joined Rémy Cointreau in 2015, one of his primary objectives was to help transform the company into a more agile organization. A key component of that transition would be the upgrade of its IT infrastructure to provide more flexibility, respond better to changing worker habits and deliver exceptional support for the business. Huet encountered another example underscoring the need for an overhaul. It took months to open their new office in Asia. One of their key objectives is to have the flexibility to open a new office anywhere in the world in a matter of days. Huet and his team set out to transform IT and with it, the business as a whole. The company was moving to a cloud-based architecture, with the goal of relying exclusively on web apps. They wanted to be able to access apps from any device, anywhere and at any time, so mobile management was crucial. And for optimal security, they needed to transfer focus from the network and the device to the applications. Identity management would be essential to achieving these goals.

Build out a cloud infrastructure to support rapid company growth. Ease the transition to cloud with single sign-on to Office 365 and other apps. Include two-factor authentication for stronger security. Protect and manage company smart phones with EMM. Nearing the end of a contract that outsourced the community services ELC supervised, the company decided to bring the services in house and offer them directly to the public. It was a large undertaking that would require nearly 100 new employees and the opening of new satellite offices. Success would depend on an environment that could support the company’s 300% growth projections. “We didn’t have the infrastructure or services necessary to handle the anticipated increase in employees,” says Luis Mena, Director of IT at Early Learning Coalition. “So we were under a tight deadline to roll out an entirely new infrastructure.” Mena decided to leverage the cloud to the greatest degree possible. “We considered building out our own on-premises infrastructure, but that approach would have required initial hardware costs in the hundreds of thousands of dollars and significantly more time and IT resources than we had available,” he says. “The ease and speed of building out a cloud-based environment made it a better choice. But we needed a strong solution that would help us in the transition.” ELC began looking for a solution that would provide authentication and single sign-on for the cloud services they were evaluating. Security would be a top consideration in any solution, as well as compliance with state and local government regulations similar to HIPAA. Strong, two-factor authentication for remote users would also be required. And if they could locate a complementary solution to securely manage their mobile devices, it would be ideal.

Simply Healthcare faced significant challenges due to rapid growth, including the need to transition to Office 365 and provide single sign-on (SSO) for various SaaS applications. The company aimed to minimize help desk tickets for password resets and reduce the time and effort required for IT to onboard new employees. The infrastructure team was overwhelmed with tasks ranging from server and network maintenance to help desk requests and employee onboarding. The decision to switch from on-premises Microsoft Office to Office 365 was made to alleviate some of these pressures. However, the team needed a solution to help with identity federation and to support the company's continuous efforts to remain HIPAA-compliant.

Find a single sign-on solution to dramatically reduce complexity, minimize calls for password assistance, increase security and help keep users engaged and using key apps. Designed to act as a portal for growers, packers, exporters and local marketers, the NZ Avocado system provides access to highly-specialized apps including a Spray Diary to log essential information about growing activities, as well as an AvoTools app and associated websites used to ensure compliance to international regulations. In order for New Zealand growers to export overseas, they must register with the association and record all use of sprays on their orchards. This is an essential component in assuring quality, guaranteeing that international standards are met and protecting a multi-million dollar industry. But with over 1350 members, NZ Avocado was having significant issues with users logging into their applications and online tools. Each app required its own set of credentials for access and that meant users had to remember multiple passwords. Compounding the issue was the fact that each orchard required its own user name and password as well, so owners of multiple orchards often found themselves managing dozens of passwords. As a result, the NZ Avocado team was frequently inundated with calls for password assistance. The problem was so great that the organization resorted to keeping user names and passwords on a spreadsheet that was available to most of the office staff. Lacking its own IT department, NZ Avocado contacted IT consultant Andrew Nimick with Point Concept, and enlisted his help in finding a solution that would dramatically reduce complexity, minimize calls for password assistance, increase security and help keep users engaged and using the apps.

With more than 400 employees, password expirations and resets at Grupo Argos had become a significant strain on IT resources. Traveling was another challenge for staff, as logging into SAP and other apps from outside the office was difficult, impacting productivity. Employees frequently had different passwords for each SAP app, and managing passwords for both privileged users and end users had become cumbersome. Concerns were raised about security because users were re-using passwords or keeping them in unsafe locations. Macs presented an entirely different set of issues, being managed locally without IT oversight. Additionally, the company had limited visibility into third-party managed servers, which was crucial for SOX compliance and troubleshooting outages.

Since its launch, Quanta Services has acquired over 200 businesses and amassed 16,000 endpoints dispersed around the world. That growth, while welcomed, has created a major privileged access management (PAM) challenge for the company. Richard Breaux, senior manager, IT security at Quanta Services, outlined the problem, “As we acquire companies, the challenge is to integrate them – taking their privileges, their computer systems and how they operate – and to make them part of our own ecosystem and to keep everything secure.” Alongside this, Quanta also faced issues common to many businesses. Breaux stated, “We have the same challenges around privileged access that many companies do, whether with local administrative rights on a desktop or laptop, or privileged access for server administration and web application development. We’re all confronted with a similar set of issues.”

A leading provider of online services to the automotive industry planned to implement a robotic process automation (RPA) solution from Blue Prism to streamline business operations. Blue Prism’s unattended digital worker robots require privileged credentials to access IT resources and automate functional tasks. In the wrong hands, these privileged credentials can be used to wage attacks or steal confidential data. The company sought to safeguard its RPA implementation without complicating security operations or slowing down the RPA rollout.

Coca-Cola Europacific Partners (CCEP) aimed to become the world’s most digitized bottler, launching multiple initiatives to increase efficiency and customer engagement. However, this digitization also brought challenges, particularly the growing risk of cyberattacks. To address these risks, CCEP's Australian, Pacific, and Indonesian operations (CCEP API) developed a three-year roadmap to enhance security measures. A critical component of this plan was improving privileged access management processes to gain better oversight and control over elevated credentials. The goal was to mitigate risks of both unintentional and malicious harm, while also reinforcing compliance with standards like PCI DSS and the NIST framework.

Icertis faced the challenge of managing rapid growth and the proliferation of administrative rights across the company. Almost every user had some degree of elevated access credential, which posed a significant security risk. Additionally, there was skepticism within the business about the performance impact of security products due to past poor experiences. Sood, the general manager of IT infrastructure, needed to find a solution that could support the company's business needs, systems, and operational environment while addressing these challenges.

The IT services unit of Erste Digital oversees critical business systems and banking software for nearly 2,200 users across multiple locations in over 10 countries. One of their key responsibilities is supporting the bank’s SWIFT infrastructure, which enables secure and efficient information exchange with other financial institutions globally. The challenge was to adhere to SWIFT’s Customer Security Controls Framework (CSCF), which requires monitoring the activity and credential usage of hundreds of users managing multiple passwords across various systems. Some applications required SWIFT certificate passwords with extraordinary length, making manual password management cumbersome and resource-intensive. Additionally, elements of the SWIFT infrastructure were not compatible with single sign-on (SSO) protocols, further complicating the management of privileged credentials and compliance with the framework.

A Financial Institution overwhelmed with the administrative privileges sprawled across their end-user environment needed a solution which would reduce the attack surface these network entry points exposed without affecting the strict Service Level Agreement’s (SLA’s) they have with their customers. With thousands of applications in use, the company’s immediate need was to remove local administrative rights from end-user machines. This was necessary to prevent end-users from granting themselves privileged access to applications they hadn’t been authorized to use. Since both Windows and Mac computers were being used to access applications, they needed a solution that would account for both operating systems. Beyond reducing insider risk, the lack of controls around local privilege management could also make it easy for attackers to establish a foothold in the company through these machines, escalate privileges and move laterally across the environment until a jackpot of data is discovered that can be exfiltrated outside of the network. To add to this, the institution needed to implement a simple process for their users to request access to the applications they may have had unrestricted access to previously, but are now being restricted by the solution. The goal was to keep the users with the minimum rights they needed to do their day to day tasks.