No-compromise cybersecurity posture for global semiconductor manufacturer

Imagination had previously deployed Palo Alto Networks ML-Powered Next-Generation Firewalls (NGFWs) in their data centre – “One of the best moves we ever made,” says Paul. This experience and the “beachhead” agreement led to the defining of several requirements:

• To protect IP using an intelligent, automated cybersecurity platform.
• To establish a SOC, unifying security operations.
• To consolidate multiple point vendors in a unified stack.
• To move security to the centre of operations, rather than it being an afterthought.

• Cortex XSIAM: The breakthrough autonomous security operations platform powers today’s modern secure operations centre (SOC) and fundamentally changes the way data, analytics, and automation are used across enterprise and cloud security operations. Imagination were part of the XSIAM Design Partner Program in 2022 and purchased licences at product availability. Imagination have now implemented XSIAM in the SOC to deliver automated end-to-end threat management wherever threats originate. This automation-first security operations platform turns widespread infrastructure telemetry, threat intelligence, and external attack surface data into an intelligent data foundation to fuel effective automated detection and threat response.
• Prisma Access: Always-on, secure remote access, providing 1,000+ users with consistent user experience and continuous protection – regardless of location. Prisma Access allowed Imagination to fully realise leastprivileged access while reducing risk with continuous trust and threat verification for all users, devices, apps, and data. For example, during the pandemic, the company was able to immediately and securely switch almost all their employees to homeworking without deploying point hardware. Having consistent security regardless of where employees were simplified operations and improved security.
• Unit 42 Managed Threat Hunting (MTH): Proactively searches for TTPs known to threat actor groups and emerging IOCs that Unit 42 are privy to via their own intelligence networks. Paul comments, “Previously, we only had a ‘Monday to Friday’ pair of eyes. Now we have 24/7 Managed Threat Hunting anywhere in the environment, including unmanaged devices and remote users.”
• Resident engineer: Two expert, embedded Palo Alto Networks professionals help make the most of the Next-Generation Firewall platform – for example, by de-risking the deployment, coordinating playbooks, and building out the operational service.

“This is frictionless no-compromise security at its very best,” says Paul, commenting on the portfolio. “Everything connects seamlessly with Palo Alto Networks – the technologies, the people, and the future roadmap.”

The benefits include:

• Secure transformation: Despite an accelerating rate of change, Imagination’s IP and people are reliably protected from known and unknown threats. Paul comments, “We are never complacent. However, thanks to Palo Alto Networks, Imagination Technologies are extremely well defended against cyberattacks. We’re confident now.”
• Automated efficiency: The three-person team are liberated from performing time-consuming manual security processes, enabling them to focus on more strategic tasks – like proactive threat hunting. For example, the number of incidents per day has dropped from approximately 175 to less than 30. Most of the balance will soon be automated too.

• Increased SOC agility with one-minute MTTR and complete visibility: Imagination is achieving a one-minute mean time to repair (MTTR) using Cortex XSIAM. Complete visibility from within the same console with the same workflows, fully integrated data, and ML-Powered automation all contribute to agile, responsive SecOps. Paul comments, “XSIAM really is a single pane of glass. All our SecOps processes happen in one place, which means less context switching and people don’t need additional skills to use multiple tools. That’s a huge saving for a small team like ours.”
• Simplified operations: Cortex XSIAM reduces manual effort, cuts delays in onboarding/offboarding employees, lowers the likelihood of misconfigurations, and provides fully-audited, repeatable processes. “Native automation means accessible automation,” Paul explains. “The intuitive ingestion of extra data sources, together with the enrichment and normalisation of that data, gives us great confidence in the data for decision-making.”
• End-to-end estate visibility: “We know about everything now; there’s no more ‘gut feel,’” says Paul. “If someone in China downloads a malicious file at 4am, we are alerted instantly. We can triage the incident automatically and quickly.”
• Agile security: The correlation of data between network, endpoint, and cloud security results in a more agile, intelligent security posture – and has led to a significant drop in the number of false positive alerts. “Even our most cynical critics now agree security is available in a single pane of glass,” says Paul.
• Support for the hybrid working model: The cloud-based solution worked well throughout lockdown – and continues to. “Prisma Access is now supporting our post-Covid/hybrid working arrangements. Given the war on talent, this flexibility is an important component in helping to attract and retain the best talent,” says Paul.

The wraparound support team are also part of Imagination’s fabric. “We’re not just a small customer at a big supplier. Customer Success, Unit 42, and executive support are continually looking after our best interests,” Paul explains. “Palo Alto Networks leadership came to understand how they could help Imagination Technologies with their teams through the Executive Briefing Centre and listened to our needs.”

Discover the Palo Alto Networks portfolio here. Read the other Imagination case studies to go into the details of how they use Cortex XSIAM and Prisma Access.