A Malaysian oil and gas company strengthened its security and compliance with MDR

Blind spots to exposure – a critical infrastructure exposed to an active adversary

As an oil & gas company, our client operated across multiple branches, with a complexly connected infrastructure with firewalls, switches, endpoints, and business-critical OT software. It was a challenge to establish centralized visibility, with each solution needing its own configuration. Their EDR was not configured to whitelist critical production-related software.

With several OT applications already behaving in ways that could be flagged as suspicious, it was critical to configure EDR to ensure resilient security without affecting production uptime. Their team was also struggling with a high volume of alerts (~3000 alerts a month) that was exhausting the team’s bandwidth and taking their focus from serious threats needing attention. To make things worse, they had no visibility of hidden risks like invisible east-west traffic and former employee accounts that remained active.

Since they were a reputed oil and gas company in Malaysia, they were also obligated to comply with data protection regulations. However, without dedicated compliance expertise, they were unable to identify and address the hidden security and compliance gaps against PDPA’s recommended safeguards, exposing them to the risks of non-compliance

• A complex multi-branch infrastructure with critical OT software.
• Enforcing strong endpoint security without impacting production-critical software.
• High volume of alerts (~3000 alerts) with false positives.

• Limited visibility of hidden security risks like dormant former employee accounts.
• No dedicated expertise to identify and bridge compliance gaps.

Unified, tuned, and compliance-ready security that doesn’t affect uptime

We integrated our client’s security stack on our vendor-agnostic, open-architecture STRIEGO platform, including their perimeter firewall and their EDR (Microsoft Defender for Endpoint). This gave them centralized visibility across infrastructure with unified telemetry from the firewall, EDR, and NDR. We offered them the domain and vendor expertise to extend their NDR coverage to east-west traffic, unify OT and IT telemetry, and onboard log sources from every branch. By tuning the detection rules and configuring the solutions against industry-benchmarked baselines and creating response playbooks, we helped the security team significantly reduce their overall Mean Time to Detect and Mean Time to Respond.

We found that there were multiple active Microsoft 365 accounts that belonged to former employees. We immediately disabled them and created a playbook to automate flagging and disabling of dormant accounts. Through continuous security advisories and threat intelligence, their security posture continuously evolved with the threat landscape, continuous advisories and threat intelligence. We also offered them dedicated compliance expertise to identify and address security & compliance gaps, create policies, continuously monitor security/compliance gaps, and ensure documentation.

• Comprehensive threat hunting and investigation
• Threat containment and environment sanitization
• Integrated, configured, and operationalized security stack
• Continuous incident response and advisory support
• End-to-end compliance support