CASE
STUDY

Butler Snow Protects Its Brand and Clients
With Intelligence from Recorded Future
National leader in law services relies on Recorded Future intelligence to mitigate risk,
make informed security decisions, and streamline the security workflow
USE CASE
Protect the brand, employees,
and clients from cyberthreats.

CHALLENGE
No real-time context or actionable intelligenceavailable to inform security decisions.

SOLUTION
The Recorded Future Intelligence Platform,
including:• Brand Intelligence• SecOps Intelligence• Vulnerability Intelligence• Threat Intelligence• Third-Party Intelligence

OUTCOMES• Identified and stopped a sophisticatedtyposquatting and business email
compromise attack• Confidently prioritizes vulnerabilities topatch using in-depth intelligence• Automated an intelligence workflow
to identify active threats and takemitigating actions• Uses Recorded Future to save hours ofwork per week amounting to adding afull-time security analyst to their team• Recorded Future provides a single paneof glass of all intelligence information
relevant to Butler Snow1

The legal industry has long been a target for cyber attackers, with
its troves of confidential client information — intellectual property,
trade secrets, personally identifiable information (PII), corporate
financials, and more. As a full-service law firm with nearly 400 attorneys
supporting more than 50 practice areas and clients in all 50 states,
the District of Columbia, and 20 countries, Butler Snow LLP is acutely
aware of the heightened risk of cyber-attacks.
“Part of our nationally recognized excellence in client service andsatisfaction is our commitment to protect confidential client informationfrom cybercriminals,” says Trey Thompson, data security analyst at
Butler Snow. “The goal that guides all of our efforts is to prevent a
successful attack by staying one step ahead of the adversary.”That’s why Butler Snow turned to Recorded Future to fill a
critical gap in the firm’s security strategy. “Before leveraging
Recorded Future’s intelligence, we relied on publicly available
information about vulnerabilities and threats,” says Thompson.
“When we saw Recorded Future in action, we knew it would provide
the single source of extensive, accurate intelligence we need to mitigate
risk, make informed decisions, and streamline our security workflows.
Recorded Future provided intelligence far beyond what we were able
to dig up on our own, especially as a team managing many priorities.”

Recorded Future® | www.recordedfuture.com

CASE STUDYWhen we saw Recorded Future inaction, we knew it would provide the single
source of extensive, accurate intelligence
we need to mitigate risk, make informed
decisions, and streamline our security
workflows. Recorded Future provided
intelligence far beyond what we were able
to dig up on our own, especially as a teammanaging many priorities."

Proving Immediate ValueFor the security team at Butler Snow, their strategy isto add as many layers of security as possible without
impeding the productivity of the firm’s approximately
800 employees, spread across a growing contingentof 25 offices around the globe. However, with a small
IT organization and an even smaller security team,fulfilling these goals requires tools that can supercharge
efficiency to help the team accomplish more.
Any intelligence solution would need to not only
improve the firm’s visibility into the most pressing
threats, but also surface intelligence in such a way thatfacilitates maximum efficiency and speedy responses by
the Butler Snow team. Recorded Future seemed to fulfill
all Butler Snow’s needs so the security team decided to
put it to a test.

Recorded Future® | www.recordedfuture.com“We conducted a proof of concept with
Recorded Future and within hours, it was alreadydemonstrating value for our firm by identifying at least
one typosquat domain,” says Thompson. “Based on theexcellent results, we were able to secure budget andmove forward with Recorded Future.” The firm now relieson the Recorded Future Intelligence Platform, including
Brand Intelligence, SecOps Intelligence, Vulnerability
Intelligence, Threat Intelligence, and Third-Party
Intelligence modules.

Protecting the Brand and Clients
Against Opportunistic Adversaries
The security team at Butler Snow uses Recorded Future
to help it protect brand value and perception, as wellas protect clients and employees from hacker methods
such as typosquatting, false login pages, stolen
credentials, and more.
Recently, a client of Butler Snow received an email thatappeared to be from a Butler Snow employee, whichcontained a change to wiring instructions for the client
to send payment to Butler Snow. When the email was
brought to the attention of the employee who wasbeing impersonated, she had no prior knowledge of it,
and contacted the Butler Snow security team about her
email password potentially being compromised.

2

CASE STUDYWith Brand Intelligence from Recorded Future, Butler
Snow quickly identified the source of the email asbeing from a typosquatted domain. The team also
used Recorded Future to find leaked credentials fromseveral of the client’s accounts, including the person
who received the email purportedly from Butler Snow.
Further forensic work by the client uncovered evidenceof Microsoft Office 365 logins from other countries into
the client’s user account.
Hackers had been viewing the client’s emails and when
they saw an invoice from Butler Snow, they created atyposquatted domain and sent an email with the fakewiring instructions. The hackers even manipulated theamount being requested, which was already substantial,
to be double the actual invoice.
“Recorded Future helped us save our client from losing
a large amount of money to a hacker scheme,” says
Thompson. Thompson and his team not only saved
Butler Snow’s client from falling victim to this attack,he also protected his brand perception with
Brand Intelligence.

Prioritizing Vulnerabilities
and Patching Efforts
Vulnerability management can be time consuming forany size IT organization. For lean teams, being able toprioritize which vulnerabilities are most important tofocus on first is essential to accurately allocating
limited resources to protect against serious threats.

3The Butler Snow security team uses
Recorded Future Vulnerability Intelligence togather context on vulnerabilities, giving the IT
organization confidence that they are prioritizing
the highest risks and dedicating resources wheremost needed.
“The intelligence we get from Recorded Future isparticularly valuable when a patch is released for ahigh impact system such as Microsoft Exchange,”says Thompson. “We use Vulnerability Intelligencefrom Recorded Future to evaluate whether avulnerability is being exploited in the wild. Actionable
information helps us drive and validate our group’sdecision on how to prioritize patching critical systems.”
Thompson shares a recent example where VMware
issued patches that could potentially impact
performance of the software. To understand whether
it was imperative to apply the patches, Butler Snowused Recorded Future to identify that the risk of thevulnerability being exploited was indeed such that thefirm needed to patch the software rather than waiting
for a later version with less impact on performance.

Manually pulling firewall logs andreviewing and researching suspicious
IPs was very time consuming before.
Now, with Recorded Future, it’s anautomated part of my regular workflow."

Recorded Future® | www.recordedfuture.com

CASE STUDY

Saving Hours Per Week With a
Proactive Intelligence Workflow
Before implementing Recorded Future, researching
IPs being blocked by the firm’s firewall and deploying
defensive mitigations took up large amounts of time andeffort. “Manually pulling firewall logs and reviewing andresearching suspicious IPs was very time consuming
before,” Thompson says. “Now, with Recorded Future,it’s an automated part of my regular workflow.”
Thompson uses Recorded Future’s browser extension toresearch the top ten IPs that tried to hit the firewall but
were blocked. He builds context using intelligence from
Recorded Future to determine if it’s something the firmshould be worried about and take action toprotect against.
“Before, I relied on public information sources to findsimilar information, which was a manual process thattook hours every week,” says Thompson. “Now, with
Recorded Future, I get the information I need within
one pane of glass.”

Before, I relied on public information
sources to find similar information, which
was a manual process that took hours
every week. Now, with Recorded Future,
I get the information I need within one
pane of glass."

Extending the Reach of a Lean Security TeamFor Butler Snow’s small security team, Recorded Futureis like having another employee in terms of enabling theteam to accomplish more. “The amount of intelligenceand context that we can quickly pull from Recorded
Future is probably the equivalent of having a full-time
person doing the work of locating the information,”says Thompson.
Asked what advice he’d give other law firms, Thompson
says, “Knowing is half the battle because you can’t
defend against what you don’t know. It's important to
not only understand what's out there, but what specificthreats to the firm exist. Recorded Future is a greatsolution to protect our brand, employees, and clientswith actionable intelligence.”

ABOUT RECORDED FUTURE
Recorded Future is the world’s largest intelligence company. The Recorded Future Intelligence Platform provides the most complete coverage across adversaries, infrastructure, and targets.
By combining persistent and pervasive automated data collection and analytics with human analysis, Recorded Future provides real-time visibility into the vast digital landscape and empowers
clients to take proactive action to disrupt adversaries and keep their people, systems, and infrastructure safe. Headquartered in Boston with offices and employees around the world,
Recorded Future works with more than 1,300 businesses and government organizations across 60 countries. Learn more at recordedfuture.com.

www.recordedfuture.com

Recorded Future® | www.recordedfuture.com@RecordedFuture© Recorded Future®, Inc. All rights reserved. All trademarks remain property of their respective owners.

4