The Bank of Marion stops a spear phishing attack with browser level visibility

Meet The Bank of Marion

Founded in 1874, The Bank of Marion is a regional bank based in southwest Virginia with over a dozen branches across Virginia and Tennessee. Their philosophy is to provide the personal service that is all too often lost in modern banking, while delivering a secure, convenient and efficient experience powered by technology. Unlike many banks that rely on third party service providers, The Bank of Marion's technology teams are employees of the bank. They invest in the people, processes and technologies necessary to maintain their reputation. After nearly 150 years in business, it's safe to say the approach is working.

A stack of tools, a gap in visibility

All banks are frequent targets of cyber attacks, and The Bank of Marion is no exception. Far more money is exchanged digitally than through cash, so threat actors are constantly searching for vulnerabilities to exploit. Malware, phishing and social engineering are routine, requiring defence in depth and a perspective of assumed attack.

The InfoSec team had implemented a stack of security tools: remote browser isolation to protect against malware, a web proxy to filter harmful domains, email attachment sandboxing to defuse dangerous payloads, and data loss prevention to safeguard sensitive customer data. Individually, each tool filled an important role. But in practice, a gap emerged. Each tool captured its own slice of event logging, so piecing them together into a contextual understanding of a security incident took hours of hands-on expertise. Reassembling a full event from these disparate systems could take days, and during incident response every minute counts.

Flipping the model

Tim Ringley is the bank's CISO and has been at the bank since 2010. He has seen every security vendor pitch how their new solution is better, faster, smarter and cheaper than the rest. When he learned about the Island Enterprise Browser at a financial services security conference, he finally saw something new: instead of adding yet another tool to a growing network stack, Island flipped the model and put the control plane inside the browser. The same protections as the collection of tools above, but with high fidelity visibility into all the activity within the browser. From the Island management console, Tim and his staff get a detailed view of all users, devices and activities, in context.

"It was probably the most exciting product I've ever heard of in my life. Island checked so many boxes for what we were missing, I couldn't wait to try it." — Tim Ringley, CISO

Rollout matched the promise. Policies and rules were configured in under two days with no heavy IT lift, and the bank went from first demo to full rollout in weeks.

"In about two days, we had everything fully ready for our test users. From there, rollout was seamless, we just pushed Island out and everyone was up and running." — Tim Ringley, CISO

The moment of truth: defeating a spear phishing attack

Within weeks of rolling out the Enterprise Browser to bank employees, Tim and the security team faced a real world attack. A local business, and Bank of Marion customer, was compromised by a threat actor who took over their email server. The threat actor then crafted a targeted phishing attack against a bank employee who regularly emailed with that customer. It was a near perfect setup: previous correspondence to copy, sent from the actual server of a trusted customer. The first phase succeeded. The bank employee opened the email and clicked the malicious link.

At that moment, the Enterprise Browser warned the user they were visiting a suspicious website and blocked them from entering their credentials. The employee immediately stopped, closed the page and reported the incident. The incident response team pulled up the timeline logs from the Island management console and verified that no credentials were compromised. An investigation that might previously have taken days was completed in minutes.

Looking ahead

For Tim and the InfoSec team, the decision to implement the Enterprise Browser was easy. They simplified their tech stack, improved their security posture and dramatically improved visibility across all web activity. The team has also been pleasantly surprised at how quickly their feature requests turn into working software. Instead of submitting requests through an impersonal web form, they connect directly with their Island support team. With intentional investments in people, process and technology, The Bank of Marion is well positioned to keep delivering the quality hometown banking service their customers expect.