Zero Trust

• After a Ransomware attack 253 plants of the customers were disconnected with unknown security status
• Customer needed a global partner for incident response in 68 countries with local capabilities to support plants on-site
• The security of all plants should be improved immediately with OT threat detection, OT EDR, and OT network segmentation as baseline measures
• In a second phase the customer requested a global MDR service for OT incl. threat detection, endpoint security, and virtual patching on network devices

• NTT DATA provides local incident response service for all plants
• Plants were prioritized based on business needs
• Main sites were back online and secured within two weeks
• Rollout of EDR solution for 253 sites was finished within 4 months
• Threat detection rollout was finished within 6 months
• Network segmentation and improvements are an ongoing project
• All new solutions are part of a global OT MDR service
• NTT DATA was able to finish the service transition for this customer within 4 weeks after the attack

• The solutions include Fortigate, FortiEDR, Claroty Threat Detection
• The installation is one of Claroty largest implementations globally
• NTT DATA provides also global project management
• Transition to 24/7 proactive management and monitoring
• Setup of all needed MDR processes on the customer site

The client reported an emergency that affected their infrastructure and was putting their OT/IoT systems at risk, which manage critical infrastructure at a national level.
The attackers compromised the infrastructure, moved laterally, installed backdoors on multiple systems, and deployed ransomware over their internal infrastructure.
The client also feared the risk of sensitive information theft and the risk of attackers attempting to sell it.

Two teams were set up to coordinate the resolution:

• 24/7 Monitoring and Incident Response team, deploying temporary agents and providing coverage for their infrastructure, including uncatalogued assets.
• Digital forensics team, investigating the incident and determining the origin of the infection, which compromised the Active Directory and servers.
• Threat Hunting team monitored the Dark web and environments finding no trace of client information being sold.

Due to the complexity of the incident, several lines of work were defined:

• Maintained 24/7 Monitoring and Incident Response to ensure follow-up attacks were detected and stopped.
• Design and deployment of a new Active Directory infrastructure.
• Hardening critical systems and servers
• Establish mid/long-term plan of security improvements in all systems, traditional and OT/IoT.

• NTT DATA Group has approximately 140k employees across 55 countries.
• NTT DATA has and continues to grow through acquisition. Each NTT DATA acquisition and geography had a different level of security protected with multi-layered perimeter security.

• Modernized - Transformed model based on Zero Trust
• Optimized vendor relationships and reduced training and license cost by leveraging a common set of solutions
• Decreased security vulnerabilities by creating a common global security strategy and framework
• Cost reduction and optimization through standardization using NIST Cybersecurity Framework across all businesses
• Cost and risk reduction through automation
• Decreased support costs and helpdesk tickets

• Zero Trust: Create a standard reference architecture built on a zero-trust framework to enable transformation
• Global Governance & SOC
• NTT DATA manage security incidents globally in 6 SOC center monitoring and handling 170 billion events per month 24/7
• Of the 630 million emails received yearly in Japan, 230 million emails per year are detoxified as suspicious emails
• Implement SOAR solution and success in automating security operations