Case study: Glasswall remediates breach at Government Research Centre

In the aftermath of a cyberattack, post-breach remediation is essential for organizations that need to mitigate damage and prevent any further exploitation of security vulnerabilities. In particular, having full confidence that files are free from lingering security threats is vital to minimizing the impact of any incident and returning to normal operations as quickly as possible.

Organizations use Glasswall CDR to sanitize and reconstruct potentially malicious files to ensure they are safe for use, preventing the spread of malware and enabling secure data recovery. For one leading US Government Research Centre, these capabilities became a key part of their post-breach remediation strategy.

The Challenge

In January 2024, a leading Federally Funded Research and Development Center (FFRDC) that provides engineering and technical guidance to the US Government detected a significant cyber breach within its technology infrastructure – its first in 15 years. Later attributed to a nation-state adversary, the attack exploited two zero-day vulnerabilities, underlining the risks inherent in their current cybersecurity ecosystem.

Having experienced a zero-day breach within its collaborative network, the research center took immediate steps to contain and mitigate the potential impact of the attack.

In circumstances such as these, FFRDCs are required to take remediation actions that focus on a range of key priorities and outcomes. These include ensuring that the threat has been eliminated, that all documents and data that may have been exposed have been sanitized and that security measures are put in place to prevent similar attacks from happening again.

The Solution

To deliver the advanced file sanitization capabilities it required, the FFRDC implemented Glasswall Meteor as a key component of its breach remediation efforts and to enhance its overall cyber security posture.

Glasswall Meteor is an automated zero-trust file protection solution that uses Content Disarm and Reconstruction (CDR) technology to treat all files as untrusted. Instead of looking for malicious content, it validates, cleans and rebuilds each file to a safe and compliant standard — automatically removing potential threats.

The solution was integrated into the FFRDC’s internal file processing pipeline, which handles large datasets, including real and sample malware, as well as files incoming to their network. The types of files processed included PDFs, where JavaScript was sanitized while allowing other content, and DOCX, XLSX, and PPTX files, where macros were sanitized while permitting all other content.

Glasswall Meteor now acts as the initial filter as part of a multi-layered security approach, including various internal antivirus systems. These activities occur before files reach internal users, file share or storage locations.

The Outcome

Glasswall Meteor’s ability to swiftly and effectively sanitize exposed documents enabled the research center to sanitize its files at scale and eliminate any lingering threat with confidence. This technology integration not only remediated the breach but also reinforced the research center’s commitment to delivering a zero-trust security architecture.

Going forward, this approach has significantly enhanced the organization's overall security posture, providing a more in-depth defense against future file-based attacks. They have also issued an industry call to action urging organizations to implement secure-by-design principles, operationalize secure supply chains, deploy zero-trust architectures and adopt adversary engagement as a routine part of cyber defense.

Learn more about Glasswall Meteor

‍