Combatting cyber crime and protecting highly sensitive data through a multi-layered security approach
Our client is one of the most successful English football clubs of all time, with multiple league, cup and European honours to their name. Like most elite sports organisations, they hold a huge quantity of sensitive confidential information – from contract negotiations and players’ medical data, to personal details belonging to the club’s global fan base. They engaged EveryCloud in a three-stage strategic security programme to keep their highly sensitive data secure in the cloud and combat increasingly sophisticated cyber attacks – all whilst maintaining user experience and productivity across the club.
Keen to understand its cloud security stance, the club first undertook a detailed Cloud Risk Assessment with EveryCloud to reveal which services were used in the business, and to understand the benefits of using cloud access security broker (CASB) technology.
EveryCloud then deployed the Netskope Cloud Security platform, to provides context-aware governance of all cloud usage across the club in real time – regardless of whether data is accessed from the corporate network, remotely, or from a mobile app or sync client. Armed with this information, security professionals can understand risky activities, protect sensitive data, stop online threats and respond to incidents in a way that the ‘work from anywhere’ world of today.
As a result, the club now has complete visibility into their cloud usage and the ability to react immediately to keep their data secure, so reducing risk and regulatory exposure – whilst enabling colleagues to reap the productivity and experience benefits of working in the cloud.
Our client then set about exploring authorisation and authentication challenges at the club. Moving to the cloud meant that traditional perimeter-focused approaches to security were no longer adequate – so a solution was required to enable secure and seamless access for all users regardless of location, device or network.
EveryCloud satisfied this requirement through the Okta Identity Cloud, unifying access across cloud and on-premise applications for all users, ensuring the right users have access to only the resources they need – and at the right time.
With traditional MFA solutions often meeting resistance from users, EveryCloud was able to help the club protect against credential theft by using Okta’s context-based adaptive multi-factor authentication, enabling a secure password-less experience – and freeing up IT resources to focus on strategic projects rather than locked accounts and password resets.
Having deployed Office 365, another challenge the club faced was an increase in volume and sophistication of phishing attacks. While they had traditional defences in place and secure email gateways (SEGs), it recognized that these phishing remediation solutions were ineffective.
We introduced our client to the IRONSCALES Advanced Phishing platform as a means to proactively defend against phishing attacks, increase anti-phishing awareness amongst colleagues and significantly enhance immediate incident response. All three of these objectives were met – as illustrated by the following incident that occurred shortly after the IRONSCALES platform was deployed.
A malicious phishing attack by-passed the club’s existing SEG. Within five minutes of the email’s arrival, a colleague reported the attack as suspicious through a single click of the IRONSCALES Office 365 reporting button. At this point, 67 mailboxes were affected. Immediately, an automatic mitigation process was triggered and IRONSCALES automatically deleted the suspicious email from all affected mailboxes and prevented any further spread of the phishing attack to any other mailboxes.
The club’s IT security team is now able to
- Block, find and fix phishing attacks in minutes or even seconds – across all mailboxes
- Remediate phishing threats remotely using a mobile app
- Clawback malicious emails in all inboxes across the club with a single click
- Save significant effort and get more done with less people
Through the club’s engagement in EveryCloud’s ‘Protect Your Sport’ programme, all colleagues are now able to work productively, seamlessly and securely from any location and on any device without compromising the club’s highly sensitive data. This enables our client to demonstrate best business practice by not only proactively protecting confidential information, but by enabling the club’s cloud-first strategy and ensuring compliance with data protection regulations.
