{"id":28485,"date":"2019-03-08T10:39:33","date_gmt":"2019-03-08T09:39:33","guid":{"rendered":"http:\/\/www.intelligentcio.com\/eu\/?p=28485"},"modified":"2023-10-11T16:48:16","modified_gmt":"2023-10-11T15:48:16","slug":"the-ardagh-group-uses-machine-learning-solution-for-crucial-visibility","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/03\/08\/the-ardagh-group-uses-machine-learning-solution-for-crucial-visibility\/","title":{"rendered":"The Ardagh Group uses Machine Learning solution for crucial visibility"},"content":{"rendered":"\n

The Ardagh Group<\/a>, a worldwide leader in packaging solutions, utilised an AI-powered network detection and response platform from Vectra to provide crucial visibility into its global network.<\/em><\/p>\n\n\n\n

The Ardagh Group is a leading global supplier of metal and glass packaging solutions for many of the world\u2019s leading brands.<\/p>\n\n\n\n

The company has a turnover of about US$8 billion, with around 120 plants in 40 countries and employs more than 23,000 people.<\/p>\n\n\n\n

The challenges <\/strong><\/p>\n\n\n\n

There are several cyber-risks that have to be managed by the Ardagh Group\u2019s CISO, David Whelan, in order to prevent financial and reputational risk to the company and its customers.<\/p>\n\n\n\n

One of the key challenges is the geographical distribution of the company, as it operates from several remote locations, outside of urban areas.<\/p>\n\n\n\n

Whelan said: \u201cEven visiting a plant has logistical issues around it. The challenges are really around not trusting the perimeter and how you go about putting in different layers of defence around that.\u201d<\/p>\n\n\n\n

Another challenge is the move to the cloud which, Whelan says, has introduced new risks due to reduced visibility.<\/p>\n\n\n\n

Email is also another target for cybercriminals, with senior executives and those in finance roles targeted on a daily basis.<\/p>\n\n\n\n

The Ardagh Group works with many of the world\u2019s leading food and drink companies so as part of the supply chain the company works hard to maintain a good cyberhygiene.<\/p>\n\n\n\n

\u201cIf, for example, we were used to try to take money out of those companies, if someone got onto our network and used us a way in, as part of the supply chain, it points back at us then and they would justifiably be very unhappy with the way we\u2019ve done our business,\u201d he said.<\/p>\n\n\n\n

The solution<\/strong><\/p>\n\n\n\n

The Vectra Cognito AI solution was implemented in July 2018. It uses Machine Learning intelligence to identify suspected attacker behaviours and alerts security analysts.<\/p>\n\n\n\n

Whelan said: \u201cIt learns what looks normal, so it\u2019s constantly monitoring the packets and it will quickly say \u2018ok, I get it, this machine talks to these five machines on a daily basis\u2019 but if that machine suddenly starts talking to six other machines, it will flag that up.<\/p>\n\n\n\n

\u201cAnd it\u2019s not intrusive on the user, we\u2019re not looking at user behaviour, we\u2019re looking at machine behaviour.\u201d<\/p>\n\n\n\n

It helps, he said, to \u2018push the normal stuff out of the way\u2019.<\/p>\n\n\n\n

\u201cWe have a SIEM which will report in, saying a machine has been trying to log into say 500 machines in the last five minutes and it\u2019ll usually be something on the shop floor that\u2019s lost its controller and is looking for something to connect to,\u201d Whelan added.<\/p>\n\n\n\n

\u201cAnd we can look at that and within 10 seconds say \u2018we know exactly what that is\u2019, but it\u2019s not worrying which at the same level is much harder to filter that out and it\u2019s harder to not listen to. So this has given us a more fine-tuned approach to identify that traffic.\u201d<\/p>\n\n\n\n

Selecting Vectra<\/strong><\/p>\n\n\n\n

Whelan said: \u201cWe had been using a different product which had been doing a good job for us for about three years but it hadn\u2019t really been developed. So we went looking in the space of network-based detection, for a product which had to have that level of Machine Learning in it.<\/p>\n\n\n\n

\u201cWe try to be as innovative as we can so we\u2019re always looking at new products to see what they do differently to what is already on the market.\u201d<\/p>\n\n\n\n

After running Proof of Concepts on two products, the Ardagh Group selected Vectra.<\/p>\n\n\n\n

\u201cTheir back-end services have been very good and the roll-out has been great. It\u2019s pretty much plug and play so we got it out there pretty quickly,\u201d Whelan said.<\/p>\n\n\n\n

\u201cWe couldn\u2019t cost justify 120 plants so I think we have it in about 30 locations at this stage all feeding back into the central brain.\u201d<\/p>\n\n\n\n

Justifying the business case for the technology to the board<\/strong><\/p>\n\n\n\n

Whelan said: \u201cFor us, in a way, it\u2019s easy because the re-routing of a single invoice between us and one of our big customers, could be worth millions.<\/p>\n\n\n\n

\u201cSo we\u2019re saying that we\u2019re putting all these controls in place to make sure that bank account details don\u2019t get changed without proper authorisation and approval.<\/p>\n\n\n\n

\u201cAnd if you\u2019ve got people in finance doing things like that then we really need to manage the risk so that someone doesn\u2019t access that data through a different path and make those changes.<\/p>\n\n\n\n

\u201cWe\u2019ve analysed what our peers are doing in this space, we analyse what\u2019s trending out there and we\u2019ll say \u2018here\u2019s the stats on it, the manufacturing sector is now a target so we have to assume that we are a target\u2019.<\/p>\n\n\n\n

\u201cWe have evidence to show we have been targeted even if we haven\u2019t been caught. And this spend is a way of identifying if someone has got past stage one.<\/p>\n\n\n\n

\u201cYou\u2019re basically saying that we can\u2019t just rely on the shell. If someone is determined to get in then they will. But at least now we have a way of detecting it earlier and maybe stopping it before it happens.<\/p>\n\n\n\n

\u201cSo you\u2019re selling it as a business risk rather than a technical risk \u2013 what the technology can bring, what risks it can address and also why we chose the locations we did instead of other locations.<\/p>\n\n\n\n

\u201cIt was all based on financial risk and where the key transactions take place.<\/p>\n\n\n\n

\u201cWe have intellectual property to a point but what we do isn\u2019t that unique. Everything we see attack-wise is an attempt to extort money from the business in some way.\u201d<\/p>\n\n\n\n

Benefits<\/strong><\/p>\n\n\n\n

The solution offers a level of visibility that the business would not otherwise be able to envisage.<\/p>\n\n\n\n

Whelan said: \u201cIt\u2019s a way of ignoring everything normal and saying, \u2018that\u2019s strange behaviour\u2019. Probably five or six of the cyberevents we\u2019ve seen already were perfectly harmless but were a very unusual way of things operating.<\/p>\n\n\n\n

\u201cIt\u2019s a level of visibility and the ability to react. Any organisation has that fear that someone is sitting on the network and taking their time and building up patterns and then will hit, so with that east-west traffic that your firewalls don\u2019t pick up, you suddenly start to detect machines that don\u2019t have a logical reason to connect to each other.<\/p>\n\n\n\n

\u201cSo it\u2019s having almost a suspicious eye over the traffic rather than the network monitors that are looking at performance issues. This is literally saying \u2018that\u2019s strange, you need to look at what\u2019s going on\u2019.\u201d<\/p>\n\n\n\n

A vendor\u2019s perspective <\/strong><\/p>\n\n\n\n

Matt Walmsley, EMEA Director at Vectra, said: \u201c<\/strong>We are trying to help our customers with the problem of time and people. It takes too long to find bad actors when they gain a foothold inside an organisation \u2013 it can take many months before that surfaces.<\/p>\n\n\n\n

\u201cWe\u2019ve built a piece of software which is fundamentally architected on Machine Learning technology which, in real time, will identify, score and surface indicators of compromise inside the organisation and give context of evidence.<\/p>\n\n\n\n

\u201cThat\u2019s a job which, if you had to do it by hand, would be very boring and repetitive and you just couldn\u2019t do it at the scale and speed.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

The Ardagh Group, a worldwide leader in packaging solutions, utilised an AI-powered network detection and response platform from Vectra to provide crucial visibility into its global network. The Ardagh Group is a leading global supplier of metal and glass packaging solutions for many of the world\u2019s leading brands. The company has a turnover of about […]<\/p>\n","protected":false},"author":28,"featured_media":99974,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[205,57,18793,649,93],"tags":[6232,9612,1257,7091,11235,3881,6817,11236,11237,11238,4858,11239,9615,11240],"class_list":["post-28485","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","category-enterprise-security","category-europe","category-manufacturing","category-top-stories","tag-ciso","tag-cognito","tag-cybercriminals","tag-cyberhygiene","tag-david-whelan","tag-machine-learning","tag-manufacturing","tag-network-based-detection","tag-packaging","tag-proof-of-concepts","tag-siem","tag-the-ardagh-group","tag-vectra","tag-vectra-cognito-ai"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/28485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=28485"}],"version-history":[{"count":7,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/28485\/revisions"}],"predecessor-version":[{"id":99972,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/28485\/revisions\/99972"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/99974"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=28485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=28485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=28485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}