EDF, a global group to be secured

The SOC team of the “Transformation and Operational Efficiency” directorate of EDF (corporate) is responsible for preventing, detecting and responding to security incidents that may affect the Group’s employees and infrastructure.

The scope of activities of this team extends mainly to Europe, as well as the United States and China. This team monitors and secures approximately 200,000 assets.

‍

What was the need?

The SOC team was looking for a sovereign, trusted information feed to detect cyber threats that could target the EDF Group.

This information had to be sufficiently contextualized and relevant to allow the team to integrate it directly into the SIEM and security tools without prior processing.

‍

Choosing Sekoia CTI

A POC was conducted for a period of 12 months in collaboration with EDF teams, Threat Quotient and Sekoia teams. This POC was demanding in its integration and successfully reached the initial objective. This integration enabled to bring a large coverage of detection of common threats (Phishing, Ransomware, Malware) that can target the EDF group.

Because of a high-quality feed and a near-zero false-positive rate, the automation, was a determining criterion in the choice of the solution and the feasibility of this project.

Despite several POCs in parallel, Sekoia was chosen for the strong expertise, the reactivity and the availability of its teams.

‍

Quality CTI with an undeniable ROI

The implementation of the Sekoia CTI feed has enabled:

• A mesurable ROI: The quality and relevance of the information made it possible to avoid calling on the SOC team’s analysts.
• Time was saved and the teams did not need to recruit to contextualize the data.
• Information enrichment leading to a 10% increase in threat detection + volume des menaces.
• Relevant detections that prevented attacks.
• A decrease in the volume of false positives passing to less than 10 for more than 1,000,000 indicators.

‍

The proof-of-concept process

Phase 1: Preparation

A kick-off meeting was organized to allow the transmission to the EDF teams.

Phase 2: Intelligence assessment

• Testing IoCs
• Source testing
• Trackers testing
• Testing of malware and threat actors profiles
• Testing of FLINT reports (Flash Intelligence Report)

Phase 3: POC Assessment

In a debriefing meeting, the EDF teams decided to generalize this POC.

Duration: 12 months