Illumio Core stopped attacks from spreading across hybrid IT 4 times faster than detection and response alone
ย Sydney Australia โ Thursday 11 August 2022ย โย Illumio Inc., the Zero Trust Segmentation company, today announced the findings from a series of emulated attacks conducted by Bishop Fox, a leader of offensive security and provider of penetration testing, designed to measure how Illumio Core can contain an active ransomware attack.ย The emulation proved that Zero Trust Segmentation stops attacks from spreading in ten minutes, nearly 4 times faster than detection and response capabilities alone.
Bishop Fox set up a purple team test environment to measure the effectiveness of Illumio Core against an active ransomware threat. The test, which mapped to the MITRE ATT&CKยฎย framework, was based on real threat actorsโ tactics, techniques, and procedures (TTPs), and ran a series of attack scenarios to measure the number of successfully compromised hosts and the time taken for an attacker to complete the attack. The findings showed:
- In a network with only detection capabilities,an advanced attacker breached all hosts within 2.5 hours.
- In a network with detection and Zero Trust Segmentation for incident response, the attacker moved beyond its initial point of entry, compromising only 1 additional host, and it took 38 minutes to contain and stop the attack.
- In a network using proactive Zero Trust Segmentation, it took 10 minutes to stop the attack and the attacker could not move beyond the first compromised host.
Bishop Fox also highlighted that:
- The stricter the Zero Trust Segmentationpolicy and enforcement modes were,ย the faster the team detected and stopped an ongoing attack.
- Illumio Core demonstrated it could significantlyย improve an organisationโs ability to proactively limit the available attack surface and reduce the bad actors’ movementย throughout the network following an initial attack.
- Illumio Core was โespecially usefulโ at covering EDRblind spotsย in locations where attacker behavior wasnโt properly detected by preconfigured EDR alerts, highlighting the importance of both detection and response technologies and Zero Trust Segmentation in building a modern, resilient security strategy to contain ransomware.
โWhen attackers move, unimpeded and often undetected, throughout an organisationโs hybrid IT, we see the most devastating consequences. Bishop Foxโs testing illustratesย that a security team tasked with identifying and stopping an ongoing attack is four times faster if they have built Zero Trust Segmentation into their environment,โ said PJ Kirner, CTO and Co-founder at Illumio. โThe difference between what an attacker can do in 10 minutes and 40 or 150 minutes is dramatic, and weโve seen reports that continued collaboration among ransomware gangs is accelerating the time between an initial compromise and ransomware deployment. Thatโs why itโs critical to pair perimeter security and detection and response strategies with Zero Trust Segmentation to stop the spread of a breach.โ
“While the results of this emulation are impressive, theyโre not surprising. In real-world implementations we see equal effectiveness using Zero Trust Segmentation like that of Illumio Core,โ said Rob Ragan, Principal Researcher at Bishop Fox. โCyberattacks like ransomware are not just a cybersecurity problem, but a resilience concern. Zero Trust Segmentation is an effective way to mitigate the risks of the propagation of ransomware; and it has become a significant market category because of its ability to transform operations, stop intruders in their tracks to limit their impact, and ultimately reduce risk and strengthen business resilience.โ
You can readย the full report here.
— ENDS —
Research Methodology
Throughout March and April of 2022, two Bishop Fox consultants conducted a succession of attack emulation on a test environment, one acting as the attacker (red team) and one acting as the defender (blue team). The team ran five attack scenarios and measured the number of successfully infected or compromised hosts, the time it took the attacker to complete the scenario, and the number of TTPs successfully executed.
ย
About Illumio
Illumio, the Zero Trust Segmentation company, prevents breaches from spreading and turning into cyber disasters. Illumio protects critical applications and valuable digital assets with proven segmentation technology purpose-built for the Zero Trust security model. Illumio ransomware mitigation and segmentation solutions see risk, isolate attacks, and secure data across cloud-native apps, hybrid and multi-clouds, data centers, and endpoints, enabling the worldโs leading organisations to strengthen their cyber resiliency and reduce risk.
ย
Illumio Contact:
Hayden Jewell
Media & Capital Partners (on behalf of Illumio)
