Global Rideshare Company improves detection of cyber threats to business data by 300% using Elastic Cloud

A large aspect of this Global Rideshare Company’s image as an innovative technology business relies on its ability to shield the organization from cyber attacks. A team of engineers led by the Cyber Defense Platform Lead at Global Rideshare Company, enforce its cybersecurity measures.

To understand the threats facing the business at any given time, their team must collect log data from multiple databases, analyze suspicious behavior, and block malicious actors. However, in the past, the company’s cyber defense platform was not in an optimal state.

The team set out to revamp its cybersecurity platform and built a prototype solution on his laptop using Elastic. They called in the Elastic team to run a threat hunting workshop to test overall detection capabilities as well as how Elastic performed against the company’s internal ‘Red Team,’ whose job is to constantly probe its cyber defenses in hopes of proactively identifying potential vulnerabilities.

With the previous system, they couldn’t thwart the Red Team’s activities. But with Elastic, they spotted their malicious activity for the first time. Having built this proof of concept, they quickly gained approval for Elastic to be deployed as the company’s principal security solution.

The Elastic Security deployment includes a server-side data processing pipeline, which ingests and transforms logs from multiple sources before sending it to a search and analytics engine. Data visualization dashboards also play a vital role, enabling its technicians to monitor systems and identify the root cause of an attack so that it can be prevented at the source.

Their cybersecurity team chose to deploy Elastic Security on Google Cloud for consistency with other components within its threat detection stack. Google Cloud also provides an agile environment where new applications can be spun up and deployed quickly in response to the fast-moving cybersecurity landscape.

Since the company deployed Elastic Security, the time needed to develop new detection rules has fallen from 10 working days to just two. The company has also been able to lower the amount of resources needed to maintain its security platform from 2.5 engineers to 0.5.

The accuracy of threat detection has also tripled. "By tripling the accuracy of our threat detection capabilities, we’re not only protecting the infrastructure but also building authority and trust throughout the organization. Employees are far more responsive to notifications and protocols than they were before," says the Cyber Defense Platform Lead.

Elastic Security enabled the company to prevent multiple threats to its systems, including denial-of-service attacks. "Elastic ensures that we can identify when security incidents take place and remediate them before there is a significant impact to the business," says the Cyber Defense Platform Lead. They also stress the quality of support their company receives from Elastic.

They are confident that Elastic has the flexibility to adapt to new threats and support the strategic direction of the company into the future. “Mergers and acquisitions are an important part of our growth strategy. Elastic gives us the flexibility to ingest ever-growing volumes of data from pretty much any source,” they say. The technology is also reaching a wider audience within the company, with the Abuse and Fraud, Global Investigations, and Insider Threat teams all using Elastic Security to build their own systems and dashboards to monitor criminal and unauthorized behavior.