Achieving Predictive Security with Epiphany

The Epiphany Intelligence Platform enhances an organization’s defensive security controls by providing an offensive analysis that identifies the most likely attack paths to critical IT assets and users, and delivers specific, actionable recommendations on how to remove them.

Epiphany uses AI-powered algorithms to identify areas of material risk, then prioritizes them based on several factors such as exploitability and how important a target is to the critical function of an organization. In addition to prioritizing the risks to an organization, several remediation recommendations are provided along attack paths. IT teams can take targeted action with minimal time investment on where and how to fix the problems.

Driven by the desire to reduce energy and operational costs, the school district was undergoing digital transformation of its building automation systems. Its leadership team wanted to place an emphasis on management controls and monitoring its buildings’ mechanical and electrical systems such as HVAC, lighting, power, fire, and security systems. However, the challenge was in gaining the benefits of improving building automation systems while at the same time managing and monitoring cyber risks.

With over 650 schools and buildings, the school district suspected there were risks they were unaware of because of the many systems and interconnections used by its platforms. This created a large threat landscape for attack. The scope of the school district network needing assessment included a combination of systems and technologies: over 120,000 computers, more than 1.2 million users, and over 300,000 devices. The school district did not have the tools nor the systems in place to comprehensibly inspect the environment for vulnerabilities, so based on Intel’s recommendation they decided to use the Epiphany Intelligence Platform.

The Epiphany Intelligence Platform is uniquely positioned for organizations as large in size and scope as the school district because large environments are where Epiphany functions best. The larger and more complex the environment, the more likely that numerous small mistakes have been made, and it’s the small mistakes that allow an attacker to gain full control over an environment. Epiphany focuses on thousands or millions of minutiae easily overlooked by IT analysts and analyzes large, complex landscapes that would be impossible for a single person or even an IT staff to analyze in a realistic time.

The Epiphany Intelligence Platform uses modeling, heuristics, and analysis in real-time, building a database of all potential devices and user-based attack surfaces (on-prem, cloud, and remote) open to exploitation. Epiphany creates actionable intelligence in a meaningful and relevant manner, with the goal of finding exploits before there is a need to analyze and respond. The risk analysis then determines targets of opportunity along attack paths, identifies an attacker’s transition points, explores potential outcomes, and sets prioritization based on business impact.

Epiphany follows a series of methodologies, drawing from industry best practices and its own internal tactics, techniques, and procedures (TTP’s), to analyze the technical risks present in an environment.

Epiphany provided dedicated resources to accomplish tasks such as connecting Epiphany to the school district’s data sources (such as vulnerability scanners), Active Directory services, and endpoint protection data, and identifying targets of material value to the functionality of the school district’s infrastructure. Epiphany evaluated potential points of exposure through automated and manual means within the school district network to determine if there were opportunities for an attacker to gain footholds into the school district’s IT environment.

Epiphany’s adversarial assessments provided actionable reporting data that the school district was able to use to address critical vulnerabilities in a prioritized mitigation strategy, including:

• Identification, guidance, and prioritization for remediation of critical vulnerabilities on computers that allow for attackers to gain a foothold in the environment.
• Identification of high-value identities exposed on vulnerable computers that can allow an attacker to directly escalate to a higher level of privilege in the environment.
• Identification, guidance, and prioritization for remediation of attack paths starting from vulnerable computers and devices leading to high-value targets.
• Identification of permission-based misconfigurations in Active Directory that enable attack paths from footholds to high-value targets, with prioritization and guidance for their remediation.

The school district found several critical vulnerabilities within the first hour of using the Epiphany Intelligence Platform and continues to use Epiphany to ensure its lines of business applications are secure and its security tools are performing as expected.

Epiphany provided the school district with adversarial assessments of its environments, which identified attack paths between facilities and IT systems. This included analyzed and prioritized attack paths across 1M+ Active Directory accounts and more than 200,000 devices.

Epiphany identified threats and provided actionable recommendations so the school district could begin addressing its vulnerabilities immediately. For each of Epiphany’s recommendations, specific servers, hosts, and users were identified along with exactly what needed to be upgraded, removed, or changed. This essentially became an actionable worklist for the school district to use to proactively address its vulnerabilities before an attack could occur.

With Epiphany, the school district found an affordable and efficient way to manage and report on cybersecurity risks across multiple existing platforms, bridging the information gaps in those systems. This resulted in immediate critical risk remediation through better awareness and prioritization.

Epiphany is a risk reduction platform. It enhances an organization’s existing defensive security controls by providing an offensive perspective. It exposes the most likely attack paths to an organization’s most critical IT assets and users, and then delivers actionable recommendations on how to remove them.

Epiphany finds hidden risks in an organization’s environment that traditional scan tools can’t. It also displays attack chains between isolated networks via domain relationships and exposed services.

Epiphany uses algorithms to identify areas of material risk, then prioritizes them based on several factors such as exploitability and how important a target is to the critical function of an organization. In addition to prioritizing the risks to an organization, several remediation recommendations are provided along attack paths. An IT team can take targeted action with minimal time investment on where and how to fix the problems.

Intel and the Intel logo are trademarks of Intel Corporation or its subsidiaries.