SBI Shinsei Bank Prepares for Risk After Ransomware Attack

SBI Shinsei Bank (formerly the Long-Term Credit Bank of Japan) is promoting a comprehensive financial model in collaboration with the SBI Group, focusing on retail, corporate, and financial services. The bank, overhauling and strengthening its network and security while building this next-generation financial platform, faced many challenges.

SBI Shinsei Bank’s IT infrastructure consists of a hybrid environment combining on-premises and cloud. However, communication requirements had become increasingly complex due to configuration changes and additions having built up over the years. Akira Takahashi (Group Information Technology Division, Deputy General Manager of Group C-SIRT Management Department), who oversees the SBI Shinsei Bank Group’s C-SIRT, reflects on the situation at that time:

“We had cases where the personnel in charge of building it at the time had since been transferred, and the communication requirements of some of our long-running servers had become a black box, making it difficult for us to understand the full picture. To overhaul the system, we had to start by figuring out what our existing servers were communicating with.”

This wasn’t just a matter of visibility. These servers would eventually need to be overhauled, but without an exact understanding of the communication requirements, there was no guarantee that they would work properly after moving to a new system. Different management approaches were required since on-premises and cloud environments use different technologies, further complicating the situation.

Security was also an issue. Among reports of damages caused by a series of ransomware attacks both in Japan and abroad, there was also a need to address post-attack lateral movement within internal networks.

SBI Shinsei Bank established its Group C-SIRT Operations Team in 2021. This was due to there being an urgent need to establish an emergency response system owing to frequent incidents in the finance industry. The bank ran internal penetration testing at the same time as establishing this system. Hiroki Kobe (Information System Operation Division, General Manager of Next Generation Core-Banking Division), who is involved in the selection of security products at the bank, explained:

“The results of the penetration testing showed us that we had sufficient measures in place against an attack from the outside. However, our vulnerabilities were revealed when we tested an internal attack scenario. Following this being reported to management, a fundamental review of our internal countermeasures was started.”

As a result of sharing the test results with management, a sense of crisis spread throughout the bank. Although patches were applied as a vulnerability countermeasure, the fundamental priority was protecting the internal network. Takahashi went on to explain the direction they took for the countermeasures:

“While endpoint protection using endpoint detection and response (EDR) is certainly important, that alone is not enough. Controlling communication in the network layer is what is effective in preventing internal movements after an attack. And so we came to the conclusion that using segmentation could prevent damage from spreading.”

The importance of multilayered protection, which protects each layer of the endpoint and network, is also clearly stated in Japan’s Financial Services Agency’s “Guidelines on Cybersecurity for the Financial Sector.” Segmentation technology can visualize communications and block them when necessary, meaning it is effective as a countermeasure against post-attack internal lateral movements.

Management’s sense of impending crisis had been growing ever since. Each time a ransomware attack was reported in Japan or overseas, the Group C-SIRT Operations Team would brief management on the situation, enabling them to fully comprehend the risk of intrusion via affiliated companies through supply chain attacks. Strengthening security governance for not only the bank, but for the entire group, was positioned as a management issue.

Virtual infrastructure products were initially considered as candidate products for implementing segmentation. However, the company decided to look at a hosted firewall product that could enhance not only network visibility but also their overall security capabilities.

SBI Shinsei Bank selected Akamai Guardicore Segmentation (AGS) after comparing and reviewing solutions based on the above requirements. There are three reasons that led them to choose AGS.　

First was its ability to centrally visualize the entire network across platforms. It simplifies management and visualization by presenting complex infrastructure viewpoint information such as subnets and IP addresses in a label-based format that is easy for humans to understand.

Second, it comes equipped as standard with granular communication control functions and protection policies against ransomware. Kazuyuki Nakazawa (Manager of Information System Operation Division), who is involved in the introduction of AGS at the bank, highly values this point.

“I highly valued its ability to make decisions using Akamai’s threat intelligence database, rather than simply controlling communications sources and destinations with port numbers. It also comes with policies for high-risk ports.”　

Third was the ability to share use cases and implementation examples with Akamai even before the rollout, based on a wealth of case studies from Japan and overseas. Being provided with detailed information, such as the time frame required for implementation and the expected number of personnel required for operation, enabled the bank to create a concrete image of what the system would look like.