CASE STUDY

CASE
STUDY

Recorded Future® More Than Doubles thePower of Credit Union’s Security Team
Real-time intelligence from multiple outside sources drives more informed business decisions
and focused action
USE CASE
Uses intelligence to gain more accurate, widely sourced
insights faster and empower its team to do more inless time.

CHALLENGE
Before using Recorded Future, critical businessdecisions and security actions were previously basedon incomplete manual research, instinct, and trust.

SOLUTION
Recorded Future Intelligence Platform:• Brand Intelligence•

SecOps Intelligence with SIEM Integration:
IBM Security QRadar•

Third-Party Intelligence•

Vulnerability Intelligence•

Threat Intelligence•

Analyst on Demand (AOD) Services

OUTCOMES

1•

Significantly increases the capacity of the
security team without adding headcount•Accurately scores vendors and other third
parties for true security risk•

Helps Hughes Federal Credit Union andpartners/vendors patch vulnerabilities at highrisk of exploitation•

Integrates with their SIEM, IBM Security QRadar,for prioritized triage, improved threat correlations,and enhanced investigations•

Helps protects the credit union’s brandand reputation from misuse andcopyright infringement•

Forms a strong foundation for a true security
culture based on real-time, trusted data frommultiple sources instead of security standing in
the way of company objectives

Overview
Originally formed in 1952 Hughes Federal Credit Union serves thecommunity of Tucson, Arizona and now has more than 166,000 members
and over $1.9 billion in assets.
Hughes has a relatively small security team consisting of Cybersecurity
Manager Judy Mayoral, the vice-president of cybersecurity, and asecurity analyst. This means much of the hands-on work is performedby Mayoral and the analyst. The fast-paced growth of the organization
pushed the security team to seek out a solution that would provide themwith reliable security intelligence to help them prioritize what matters.
The team turned to Recorded Future Intelligence Platform to more
efficiently sift through the vast amount and variety of data that pours in
on a daily basis.
Deploying the solution has been a great boon to the organization,
as Mayoral points out: “Recorded Future is invaluable, as it helps us
determine whether something is an active threat or a past threat,something to prioritize or not give as much importance. We also use it
for research purposes, such as for vendor selection and management.
As the company continues to expand quickly, we need to make sure that
we're staying nimble and on top of things—and Recorded Future enables
us to do so.”Recorded Future® | www.recordedfuture.com

CASE STUDY

Much of our time is spent making
educated, risk-based decisions regarding
vendor contracts. This is where we lean
on Recorded Future."

Accurately Assessing Vendor Risk
Hughes Federal Credit Union has numerous vendor
relationships. A core piece of the organization’s
business is working with auto dealerships that arelooking to finance customer purchases through thecredit union. In fact, this constitutes about 70% of
their business. Apart from auto loan-related entities,
Hughes partners with solution providers, vendor
management software companies, and technicalvendors such as Cisco and IBM. Additionally, thecredit union also evaluates companies they arelooking to merge with or acquire.
As Hughes identifies new vendors they want towork with, they strive to do appropriate due diligence.
“Much of our time is spent making educated, riskbased decisions regarding vendor contracts.” remarks
Mayoral. “This is where we lean on Recorded Future.”
Prior to Recorded Future, the vendor evaluation
process was largely guided by gut instinct or trust.
When a vendor approached Hughes, the credit union
would get to know them, get a feel for their business,and look at their security operations center (SOC)
documentation or due diligence package. Basedon that information, the credit union would make adecision about next steps which would include whether
to escalate to a third party for a quantitative risk
assessment, initiating the relationship, or opting not topursue a business relationship.

Recorded Future® | www.recordedfuture.com“The piece that was missing for us in evaluating
vendors was data on the stability of the company andthe risk that they had out in the world. When we really
started to leverage Recorded Future, we found thatsome vendors we conducted business with historicallywere high risk and compromised. For example, we
discovered that their information was on the dark web.
We wouldn’t have known that without insights from
Recorded Future. Now we can identify whether thevendor had any security problems that were publicly
disclosed or revealed on the dark web,” she says.
The Recorded Future Third-Party Module assigns
vendors, partners, and other third parties with anumerical cyber-risk score, which eliminates theguesswork. Mayoral continuously keeps a vigilant eyeon the vendors Hughes does business with, checking
for breaches, potential vulnerabilities, ransomware,credential compromise, and other security challenges.
For core vendors or service providers that have directaccess to the Hughes environment and would posea risk to the business if compromised, Mayoral uses
Recorded Future to track their usernames. If herteam sees those usernames on the dark web, they
then notify the vendors so they can conduct further
investigations and remediations.
“When Recorded Future flags us that there's a
problem, that's usually an indicator that we shouldn't
be doing business with the vendor or that we need toexercise extra precautions when working with them,”
she asserts.

2

CASE STUDY

Recorded Future provides us with
substantial reporting and tools to see ifanybody we do business with is vulnerable
to Log4j attacks. Additionally, they help us
to discover other indicators of compromise(IoCs) and determine whether adversaries
are targeting us or attacking us."Vulnerability Management Adds
Richness to Vendor Profiles
By using Vulnerability Intelligence from
Recorded Future, Mayoral and her team candetermine whether the credit union’s vendors andpartners are vulnerable to zero-day attacks or otherthreats. Leveraging machine learning, Recorded Future
scores vulnerabilities on their likelihood of exploitation
based on real-time data from open, dark web, andtechnical sources. This allows Mayoral and her teamto prioritize and act on vulnerabilities days before
they are published in the U.S. National Vulnerability
Database (NVD).
The Apache Log4j flaw, which was discovered in
December of 2021, is a clear example of a zero-day
vulnerability that has impacted numerous businesses
across multiple sectors. It gives remote attackers
the ability to commandeer a system in order to installmalware, execute payloads, steal data, or damage
the system. Fortunately, Hughes was well-bufferedagainst Log4j, so they did not take a hit like many otherorganizations did, but the credit union was concerned
about third parties potentially being victimized.
“Recorded Future provides us with substantial
reporting and tools to see if anybody we do businesswith is vulnerable to Log4j attacks. Additionally, they
help us to discover other indicators of compromise(IoCs) and determine whether adversaries are targeting
us or attacking us,” she says.

3

SIEM Integration Enriches Context andMakes Information More Accessible
An important benefit of the Recorded Future SecOps
Intelligence Module is that it integrates seamlessly with
IBM’s Security QRadar, a Security Information and EventManagement (SIEM) solution implemented at Hughes.
Recorded Future feeds real-time intelligence into
QRadar, giving Mayoral and her analyst the information
they need to make quick, confident decisions.
As Mayoral puts it, Recorded Future “sees the outside
world,” helping Hughes prepare for possible threats.
By bringing QRadar and Recorded Future together,
Mayoral and her team have been able to enrich theoverall data set in the SIEM. The SecOps Intelligence
integration with QRadar enriches SIEM data withrisk scores that provide context for the actual
risk associated with exploitation of each Common
Vulnerabilities and Exposure (CVE). Recorded Future’s
risk scores supplement CVSS scores to help Mayoral
and her team prioritize the security patches that mattermost based on the likelihood that a vulnerability would
be exploited.
Thanks to the integration, Mayoral and team can build
customized alerts. “For example, if internal users are
visiting websites that are allowed through our firewall,but Recorded Future indicates that these URLs have ahigh risk score, then we get notified. That way, we cansee that there could be a problem with a website andfine-tune our alerting. This gives us a good perspectiveon what our employees are doing and what ourapplications are doing—and this helps us better protect
both,” Mayoral explains.
Employees outside of Mayoral’s immediate security
team benefit from the enrichment that Recorded Future
provides, too. For example, the infrastructure teamuses the guidance of Recorded Future data in QRadar
when executing security patching.

Recorded Future® | www.recordedfuture.com

CASE STUDY“More people in the organization can be touchedby or can get the benefit of the intelligence just by
virtue of having this integration. This makes the data
understandable to them. When they see a bright red
score of 78 from Recorded Future, they know there’s aproblem, but if the score is zero, they don’t have to beconcerned,” Mayoral observes.

Curtailing Brand Abuse and Impersonation
Non-technical teams—such as finance, operations,and marketing—regularly make use of theRecorded Future Brand Intelligence which collects
information, such as domain registration data, social
media profiles, and malicious websites from its
many sources. This capability helps Mayoral and herteam immediately find leaked credentials, typosquatdomains, brand infringements, and other digital risks.
At one point, Mayoral received an alert from
Recorded Future about suspicious Bank Identification
Numbers (BINs), which indicate the first six digits ofa credit number. She immediately involved the fraud
operations team who determined that these credit
cards were live cards that needed to be shut down.
They took a deeper look at that intelligence andenriched it with their own knowledge and were able
to determine that these credit cards were part of alarger breach and could be published on the dark
web or used by fraudsters. By putting all the pieces
together, the fraud operations team prevented theaffected credit union members from having any fraudon their accounts.
Similarly, when Mayoral and her team spot an email
address from an executive account that has beenfound on the dark web by Recorded Future, they can
immediately have the holder of that email addresschange their passwords and credentials.

Recorded Future® | www.recordedfuture.com

The marketing department at Hughes makes use of
the Brand Intelligence Module in several ways,
facilitating corrective action by the security team ifnecessary. For example, with Recorded Future Brand
Intelligence, the marketing department can see where
the brand is being used and how it's being used.
According to Mayoral, Brand Intelligence has been
especially insightful for phishing pages. “We are able
to predict and detect when a phishing site is being
spun up, and when phishing emails are coming basedon the notifications and alerts from Recorded Future,”
she affirms.
In addition, Mayoral and her team can see whether
the credit union’s website code has been copied byunauthorized individuals to PasteBin, a hosting sitewhere users can store text online for a set period oftime and share with anyone and everyone. Again, if
this does occur, they can decide on how to address
the situation.
“If it's a true typosquatting site, I take it down, or I
work with our vendors to take it down, but, if it's justan innocent brand infringement, it allows us to reachout to the violator so they can handle it their way,”says Mayoral. “Recorded Future Brand Intelligence also
lets us know if somebody is talking about us on social
media, because we get those alerts as well. We canthen follow up on comments that may be negative or
damaging to our reputation.”
Prior to Recorded Future, the credit union had little tono visibility into typosquatting. “Having the ability tomonitor for typosquat domains has protected us somuch. We've had so many site impersonations that
we had to act on. Recorded Future has enabled us todetect about six typosquatting domains per year—
something we could never do before,” notes Mayoral.

4

CASE STUDY

Expert Analysts from Recorded Future
Expand and Complement the Security TeamTo supplement the work done by her team, Mayoral
regularly takes advantage of Recorded Future’s Analyst
on Demand (AOD) Service. Recorded Future’s highly
experienced intelligence analysts can take a deeper
dive into alerts that appear in the credit union’senvironment and provide insights into threats that are
targeting financial institutions of a similar size andscope, along with incident response guidance, ondemand flash requests for particular alerts, and regularreviews and reporting.
As part of her process of preparing high-level reports
for the board and cybersecurity committee, Mayoral
augments the AOD reports with other data she collects,
such as results of phishing simulation tests. She
presents this data to executive management in orderto help them understand the organization’s security
posture and make informed decisions about budget
and resource allocations.
“Recorded Future presents our actual risk, which canbe compared to our acceptable risk. This helps us gain
buy-in when we need to justify expenditure of funds for
additional resources, such as headcount or new tools,”
asserts Mayoral.

Fostering a Security Mindset
Hughes is committed to expanding security awarenessamong all its employees, and Mayoral is a major
influencer in that effort. She conducts annual training
for all employees and is especially focused on newhires, ensuring that everyone understands how criticalsecurity is and how important it is to report anythingsuspicious. She enhances her training curriculumwith Recorded Future’s web content and webinars on
ransomware and other threats.

5

On a day-to-day level, she offers practicalinformation to employees on why a particularwebsite is being blocked, backed up by risk scoresfrom Recorded Future. Quite often, employees needto go to various websites to do research not just on
dealerships but also on specific vehicle makes andmodels to ensure proper financing. At times, thisresults in a visit to a malicious site. Recorded Futurecomes in handy when this occurs, as it provides
the security team with alerts, so they can block
those URLs.
“When a website isn't accessible, I can show usersthat it has a high risk score of 79 out of 100, and it's
been known to have phishing or malware associatedwith it. That way, I can offer justification for what we're
doing. And we can do the same thing with vendors
as well if a user is looking to establish a business
relationship with a particular company,” she relates.
She assists users with due diligence or vendor
management program processes by using theThird-Party Intelligence Module to look up
company risk scores.
Recorded Future has helped Mayoral and her teamserve as trusted and helpful facilitators. They havebeen successful in their efforts to change the way
employees view security at Hughes. Users have cometo understand that her team is not letting security getin the way of processes. Mayoral has won the hearts
and minds of employees to such an extent that they
are now conscientious about reporting problems to herteam, such as malicious sites or socially engineered
phishing emails.

Recorded Future® | www.recordedfuture.com

CASE STUDY

Automation Leads to Augmentationof Team Capabilities
As Mayoral states, “Recorded Future has more thandoubled the capacity and effectiveness of my team.”
Recorded Future SecOps Intelligence provides readyto-use, high-confidence threat data eliminating theneed to perform manual research. Armed with real-timerisk scores and indicators of compromise (IoCs), herteam can quickly eliminate false positives, prioritize
alerts, and do deeper investigations followed by triage
where required.
Recorded Future Vulnerability Intelligence has
also automated processes. In the past, reviewing
vulnerability scans was an exceedingly time-consuming
job. Mayoral’s team had to review every single CVE in
conjunction with the critical asset scanned, such as
firewalls and Microsoft Windows tools. Recorded Futurepairs CVEs with their associated assets, so it’s easy to
see which CVEs may be high risk for any given asset.

Additionally, the depth and breadth of intelligencein Recorded Future helps the team more quickly
and easily pinpoint risky sites. Rather than manuallyfiltering through dozens of websites, they simply enterthe URL into Recorded Future and immediately get arisk score.
“When we do have an incident or need to researchsomething, we're able to have one person handle theissue. And this individual doesn’t have to be skilled
in multiple different systems. They only need tounderstand IBM Security QRadar, which gets all of theRecorded Future intelligence and delivers context andhelps connect the dots. We can then make educateddecisions as to whether something is actionable or afalse positive—and that allows us to better prioritize
our time.”“Recorded Future does a lot of the work for us.
I don't have to drill into each and every single CVE
and determine its risk or likelihood of exploitation. And
because it ties the CVE and risk level back to the asset,
I can decide whether it’s necessary to take action ornot. This keeps us from wasting time deciding whether
a vulnerability is something we need to be paying
attention to based on the asset it's coming from,”says Mayoral.

ABOUT RECORDED FUTURE
Recorded Future is the world’s largest intelligence company. The Recorded Future Intelligence Platform provides the most complete coverage across adversaries, infrastructure, and targets.
By combining persistent and pervasive automated data collection and analytics with human analysis, Recorded Future provides real-time visibility into the vast digital landscape and empowers
clients to take proactive action to disrupt adversaries and keep their people, systems, and infrastructure safe. Headquartered in Boston with offices and employees around the world,
Recorded Future works with more than 1,300 businesses and government organizations across 60 countries. Learn more at recordedfuture.com.

www.recordedfuture.com

Recorded Future® | www.recordedfuture.com@RecordedFuture© Recorded Future®, Inc. All rights reserved. All trademarks remain property of their respective owners.

6