CyberArk

While digitization is increasing efficiency and significantly growing customer engagement, it also comes with several challenges, not least being the growing risk of cyberattacks.This led the company’s Australian, Pacific and Indonesian operations (CCEP API) to create a three-year roadmap for developing and implementing enhanced security measures. A key element of the plan has been to improve existing privileged access management processes and gain heightened oversight and control over the use of elevated credentials.

Capcom, a leading worldwide developer, publisher, and distributor of interactive entertainment, faced a significant challenge in improving its security measures. The company's game business, known for its advanced technological development capabilities, develops its own game engine based on fundamental technology. This proprietary technology approach has positioned Capcom as a leader in the game industry. However, the game development department handles vital data assets using a dedicated development environment for each project, which necessitates stringent security measures and compliance with laws and regulations of each country and region. Capcom had been focusing on strengthening security measures, but to work on more advanced measures and higher levels of protection, a dedicated Development Security Task Force was established. The task force began studying the introduction of technologies and mechanisms to protect valuable information assets.

The Court of Justice of the State of Amapá, a judicial body in Brazil, was faced with the challenge of updating and streamlining its justice system in the face of unpredictable, complex, and urgent cybersecurity threats. The Brazilian Superior Court of Justice had previously been a target of a ransomware attack, which halted operations for a week and affected up to 12,000 pending lawsuits. In response to these threats, Brazil’s National Council of Justice launched ‘Justice 4.0,’ a package of reforms designed to modernize the justice system by adopting technology to improve access, transparency, and speed. This required each state judiciary to implement an identity security and management system. The Court of Justice, Amapá, needed to boost its safety procedures, particularly Identity Security, to meet these compliance demands and to better match larger business and market trends. The shift to remote work during the COVID-19 pandemic further highlighted the need for a strong identity management solution.

Gamania Group, a Taiwanese conglomerate with businesses in online gaming, e-commerce, e-payment services, and IT, was facing a significant cybersecurity challenge. With over 10 million registered members worldwide, the group was a prime target for hackers and ransomware attacks. The group's flagship business, Gamania, a mobile games publisher, was particularly vulnerable due to the nature of its operations. The company manages one of the world's most famous massive multiplayer online role-playing games, MapleStory, which attracts a diverse range of participants, including malicious individuals intent on causing damage or seeking to extract money from the business and its customers. Other businesses in the group, such as the GASH Mall online payment system and GAMA PAY payment-payment service, were also prime targets for cyberattacks. Aware of the high-level threat it faced, Gamania Group set out to build a modern and robust cybersecurity defense strategy.

Federated Insurance, a national insurance business based in Owatonna, Minnesota, was facing challenges in managing cybersecurity risks, particularly in the area of privileged access management and identity protection. The company was aware of the growing threat of cyberattacks, especially for organizations in the financial sector. A few years ago, the company reviewed its cybersecurity capability and realized that it could be improved. The company found that most passwords were written down somewhere or linked to user IDs, which posed a significant security risk. The company wanted to make privileged accounts easier to manage so people did not have to keep remembering long passwords or write them down. Additionally, the company was aware that regulations and insurance standards around cybersecurity were getting tougher, so it needed more robust privileged access and identity protection.

Garanti BBVA, Turkey’s second-largest private bank, faced a significant challenge in securing its privileged accounts and identities used in its DevOps and cloud environments. With a broad attack surface due to its extensive business lines and 18,000 employees, the bank needed to protect against the theft of privileged credentials. The bank also had to ensure compliance with stringent data security regulations within both the Turkish and global financial sectors. As one of the pioneers of internet banking in Turkey, Garanti BBVA was pushing forward its digital transformation journey, which increased its in-house development operations (DevOps) to improve application and service delivery. This transformation resulted in a need for more robust security tools.

Healthfirst, the largest not-for-profit health insurer in New York State, faced a significant challenge in evolving its cybersecurity operations. With a rapidly growing member base of 1.8 million and an increasingly complex healthcare landscape, the organization needed a robust cybersecurity program. Healthfirst holds a comprehensive database of member-related information, including enrollment, billing, customer care, payments, processing claims, and health data. The protection of these highly sensitive healthcare records and identities of members and staff was paramount. The organization had adopted a cloud-first strategy, with approximately 70% of systems and applications now cloud-based and 10,000 endpoints, 70% of which are remote. This required a sophisticated and robust security solution. The organization aimed to transform the industry by digitally enabling its members, which included heavy investment in digital apps, virtual community-based offices, and mobile solutions.

Kainos, a UK-based digital technology company, faced a significant challenge in securing sensitive data across its global workforce. With over 3,000 employees in 22 countries, the company had to ensure secure remote work and client location operations. The company's employees had the freedom to choose, download, and install applications, which, while convenient, posed a security risk. An audit revealed that there were 50,000 different applications in use globally. The company also faced constant threats like phishing, fake Office 365 password reset scams, and LinkedIn targeting for new starters. The challenge was to enhance security without hindering the work of different user groups, including developers, business staff, and senior executives, who required varying access rights.

Maximus, a global government services company, was in the process of implementing a digital transformation strategy to improve program efficiency, work smarter, and drive productivity and quality. A key part of this strategy was the transition to a cloud-first enterprise through the migration of key systems and applications to the cloud. This change provided an opportunity to rethink and strengthen the company's approach to privileged access management (PAM) across the organization. However, the existing PAM solution that had been selected for Maximus' legacy environment required a lot of customization, had limited integration capabilities, and could not handle complex use cases. The challenge was to create widespread improvements across the $3.4 billion corporation with only a modest-sized team and limited resources.

o9 Solutions, a leading AI-powered planning, analytics and data platform provider, faced a significant challenge in ensuring the security of its Fortune 500 customers' data. The company delivers its services via a multi-tenant cloud environment based on AWS, Azure and Google, making identity protection and management crucial to access control. However, as cyber threats became more widespread and sophisticated, the visibility of identity and threats became poor and disconnected. There was no centralized way to monitor and control the various cloud environments the company used. The company needed to develop a more robust and effective Privileged Access Management (PAM) capability to match or exceed the cybersecurity and corporate governance strategies of its large, global customers. The customers needed reassurance about how o9 Solutions managed and controlled access to their data and the environment.

Pacific Dental Services (PDS), a leading dental support organization, was faced with the challenge of managing and controlling a large number of privileged accounts, passwords, and mobile devices across its geographically dispersed teams. The company supports over 900 dental practices and is responsible for protecting the personal and sensitive healthcare information of dentists and their patients across the U.S. PDS team members had access to approximately 20,000 clinical service websites, and passwords for these sites were recorded on an intranet-hosted spreadsheet, leading to security issues and chaos. Additionally, PDS manages over 5,000 laptops and mobile devices for team members based at their National Support Offices and a good number of remote/mobile team members. Admin rights were being granted, often for basic things like installing a web camera or updating a driver. However, these admin accounts would stay with the device, sometimes for years, posing a security risk. PDS needed a better way to monitor and manage user access across this environment.

A leading European bank, serving over ten million customers, was looking to enhance its digital banking services with Kubernetes and cloud-native computing environments. However, with the increased digitization of services, security became a paramount concern for the bank’s stakeholders and clients. As the bank initiated its journey to the cloud, it adopted a variety of cloud-based technologies to rapidly address and respond to new business needs, such as providing customers with secure home banking services and secure apps for mobile phones. The bank realized that adopting cloud and related open-source technologies came with a price in terms of management and security constraints. One of the most critical aspects of the cloud journey was how to properly manage identities and secrets (privileged credentials or grants) across different cloud services. Managing secrets across different cloud and hybrid services are typically a pain point in every organization’s cloud journey.

Svensk Travsport, the governing body for Swedish trotting, was facing a high number of cyberattacks on its sensitive data. The data included information about races, transactions related to horses, rider and horse performance, history of wins, and horse pedigrees. This data was used by owners, trainers, and the public to make investment, training, and betting decisions, making it a prime target for cyberattacks. In addition to this, the organization had to comply with constantly changing regulations such as GDPR. The data also included information on staff and around 15,000 external members such as riders, owners, and breeders. The cybersecurity landscape was also changing, with a shift from on-premises to the cloud, requiring a different protection approach. The organization aimed to achieve a high level of assurance for data and stakeholder protection while making access to data and applications easy for users.

Tribunal Regional do Trabalho da 8ª Região (TRT8), a judiciary body in Northern Brazil, was facing a surge in cyber attacks, a situation that was particularly concerning given the sensitive nature of the data they handle. The organization had recently digitized its court case management system, making all information related to court procedures, including highly sensitive personal information about individuals involved in employment disputes, digital. Despite having a robust security strategy, TRT8 had little control over users and passwords with access to this information, and privileged access was decentralized. Enforcing security information policies such as regularly changing and updating passwords was a manual and time-consuming process. Endpoint protection relied on a basic anti-virus tool, leaving the organization vulnerable to viruses or malicious attacks that could disseminate throughout the network and harm court operations.

Turkcell, a leading digital operator in Turkey, faced a significant challenge in protecting its 40 million customers, 300,000 network devices, and 40,000 employee and partner identities across Turkey, Ukraine, Belarus, and Northern Cyprus. As the largest telco in Turkey, Turkcell offers a wide range of services, making cybersecurity a critical business operation. The company has won several awards for its digital security products and plays a key role in the Turkish cybersecurity industry. However, the company's aggressive digital transformation path, which includes new digital services such as instant messaging, TV and music platforms, personal cloud services, search engine, and email services, increased its attack space. The COVID-19 pandemic further complicated matters as most staff began to work remotely, potentially exposing Turkcell to new, unforeseen risks. A risk assessment initiative highlighted a potential vulnerability in Windows servers, prompting the company to seek a robust security solution.