Financial Services - Solution Brief

ORDR Systems Control Engine for the Financial Services Industry

Simplified Security and Compliance for All Connected Devices

The financial services industry faces extraordinary security challenges, and to keep pace, security efforts must be both comprehensive and efficient. In terms of threats, recent studies have found that cyberattackers hit financial services firms 300 times more than other sectors. At the same time, security teams must maintain and document regulatory compliance with a wide array of standards ranging from PCI-DSS, FNRA, and FFIEC. To make matters worse, teams need to secure a wave of new IoT devices that are often ignored by traditional security tools. Whether dealing with traditional laptops and servers, or ATMs, POS devices, security cameras and sensors, or connected facilities equipment, financial services security teams need to ensure that all their devices are safe and properly controlled.

ORDR arms security teams with the tools to easily maintain full visibility and control over all their connected devices. The platform ensures security and IT teams always have a comprehensive inventory of all assets, insights into the behavior, risks, and threats of each device, and the ability to take action and mitigate risks automatically. Whether for addressing regulatory compliance requirements, proactively managing risk, or enabling key security initiatives such as NAC deployments, micro-segmentation, or Zero Trust, ORDR ensures financial services organizations teams have visibility and control they need for unmanaged, IoT and OT devices.

Key capabilities include:

How ORDR Works

The ORDR Systems Control Engine (SCE) is the only purpose-built platform to discover and secure all connected devices. ORDR uses a completely agentless approach, and can be deployed locally or in the cloud. The SCE passively analyzes network traffic to detect and classify all devices, and automatically find vulnerabilities, weaknesses, and threats. Every device is continuously analyzed to baseline appropriate behaviors, map communication patterns, and identify any malicious or anomalous traffic.

ORDR also takes action to mitigate risks. By learning the unique communication patterns of each device and class of device, ORDR can proactively create firewall, NAC, or other policies that ensure devices have the access they need while limiting unnecessary exposure. When threats or other incidents are detected, ORDR can likewise dynamically create segmentation policies to isolate or quarantine devices. ORDR also integrates with existing security and asset management workflows such as SIEM, CMDB and CMMS.

With this unique approach, ORDR ensures a single, complete view of all devices and their risks, and empowers teams to take quick action when required - all without the need for endpoint agents.

Key Use Cases for Financial Services

Inventory and Management Of All Connected Financial Devices

ORDR ensures comprehensive coverage of all the many connected devices in financial environments. This includes traditional devices such as laptops, desktops, and servers, both locally or in the cloud. ORDR also ensures visibility of other connected devices that are often missed including BYOD and WFH devices as well as IoT and OT devices including ATMs, POS, security cameras, loss prevention devices, and building facilities assets.

Securing SWIFT Environments

As of January 1, 2018, SWIFT requires all 11,000+ SWIFT member banks to comply with their Customer Security Controls Framework (CSCF) or risk non-compliance. The SWIFT CSCF is designed to drive security improvement and transparency, and includes broad requirements to secure member banks such as restricting Internet access, protecting critical systems from general IT environments, reducing the attack surface and vulnerabilities, and securing the environment. ORDR can help deliver complete visibility into financial organizations and their SWIFT environments, including discovery of all connected devices and monitoring these environments for anomalous traffic. The ORDR machine learning capabilities can baseline what is normal in the environment and create appropriate segmentation policies to secure unmanaged and IoT devices.

Regulatory Compliance

ORDR vastly reduces the time and effort needed to maintain compliance with a wide array of regulatory standards including the FFIEC IT Handbook, PCI-DSS, SOX, GLBA, NYCRR-500, FNRA, and more. Security and IT Teams can rest assured that they can provide comprehensive visibility and documentation of all their connected devices. ORDR also makes it easy to hone in on specific areas or attributes such as identifying whether devices with PCI cardholder information are in the same VLAN as other non-PCI devices. Additionally, teams can quickly focus on specific regulated device types or attributes such as ATMs, POS devices, or devices with outdated operating systems.

NAC Augmentation

Financial institutions are increasingly turning to NAC to help secure their environments. However, security teams can't enforce NAC policies until they are confident that they know what each device actually is. Without this insight, teams are often forced to create broad "allow policies" for devices, which often defeats the purpose of deploying NAC in the first place. ORDR provides the all-important prerequisite for NAC by automatically identifying each device in detail so that organizations can actually deliver on the promise of NAC.

Simplify Mergers and Acquisitions

ORDR brings clarity to the M&A process both before and after an acquisition. IT and security teams can quickly establish a comprehensive inventory of devices and automatically identify vulnerabilities and risks. Teams can quickly see devices and technologies by type to see where there is overlap or differences between the two organizations. If problems are uncovered, ORDR then allows teams to automatically create segmentation policies to mitigate the uncovered risk.

Microsegmentation and Zero Trust

ORDR lets financial organizations easily adopt modern security models and architectures such as microsegmentation and Zero Trust. ORDR automatically analyzes all traffic with machine learning to identify the unique connectivity needs of each device. This traffic mapping or “ORDR Flow Genome” provides the baselining of normal device behavior. This enables ORDR to automatically create segmentation policies to only allow access to the sanctioned devices and services needed. Policies can be manually reviewed by staff before enforcement on existing networking or security infrastructure. Policies can also be automatically deployed to ensure the fastest time to protection.

Case Study: Regional Bank

A large regional bank with several hundred branches spread across 17 states recently needed to extend security to their many devices. The security team was facing a variety of challenges. The team needed to support a wide variety of devices including remote ATMs and loss prevention cameras in addition to traditional laptops and servers. The team was also having challenges related to their Cisco ISE NAC deployment. Specifically, many devices were only identified by their IP address, forcing teams to create broad "allow policies" for NAC.

ORDR was able to come in and quickly solve these problems, while also uncovering risks that had previously gone unnoticed. ORDR provided visibility into all the organization's devices including their ATMs and other IoT and OT devices. By automatically identifying all devices, the security team was able to greatly enhance the NAC solution by applying policies based on specific device types and attributes. ORDR was also able to identify a variety of hidden risks including devices with expiring certificates as well as devices communicating with known malicious IPs and domains. With minimal time and effort from the security team, ORDR was able to establish a consistent approach to device security, extend existing security tools, and address risks that otherwise would have been missed.