How Thoughtworks and Coalfire optimize risk management

CHALLENGE

Increasing adoption of distributed cloud environments means an expanded attack surface that presents more opportunities for bad actors. Traditional security approaches have lost their effectiveness in preventing cybercrime. As an open-source pioneer and thought leader in cloud-driven AppDev and the Zero Trust movement, Thoughtworks has always recognized the importance of integrating an offensive adversary mindset and implementing ongoing penetration testing as a vital part of its risk management toolkit.

From Thoughtworks’ Decoder section on its website:

Like rainwater soaking into the ground, attackers are exploiting every weakness and penetrating cloud environments with alarming skill and speed. Previously used defensive cyber postures are becoming obsolete – Thoughtworks recognized a need to integrate today’s offensive adversary mindset into better protecting internal and external development security operations.

APPROACH

For Thoughtworks, security is more than just table stakes for its clients. Working with its cloud service provider and Coalfire on modernizing its cyber program and risk posture, Thoughtworks:

• Strengthened its ability to think like an attacker through alternative analysis and emulation.
• Implemented an enhanced pen testing program using Coalfire's advanced automated platform and cross-industry offensive security expertise.
• Simulated individual attack patterns and long-term scenarios based on the Thoughtworks threat model, including specific adversaries and Advanced Persistent Threats (APTs).
• Strengthened its vulnerability management program to identify and address new hosts, run times, protocols, cloud misconfigurations, and anomalous behaviors.
• Implemented enhanced threat hunting activities to detect indicators of compromise, improve detection capabilities, and minimize attacker dwell times.
• Improved upon its ongoing red teaming and purple teaming exercises from the perspective of an attacker.
• Increased engagement of its engineering teams in remediating complex findings, treating security issues in the development lifecycle as urgent situations that require immediate attention.

Thoughtworks relied on the MITRE ATT&CK® framework to improve upon the vulnerability stacks, which help inform and refine their defensive capabilities, aligning with specific threat models and improving their offensive strategies.

“We believe in emulating adversaries for defensive purposes and challenging our systems at every stage,” said Raina. “Best-practice pen testing has to be ongoing, always increasing the security IQ of our clients and our company.”

RESULTS

By partnering with Coalfire, Thoughtworks achieved notable improvements and benefits, including time-to-remediation measures, and a reduction in risk scores aligned with business outcome prioritization. Additional advantages include:

• Measurable enhancements in program maturity through automated external pen testing, emulation, and red teaming, resulting in improved attack surface visibility.
• Enhanced validation tools for oversight and reporting to the board and C-suite.
• Additional continuous and on-demand assurance to executives, partners, and customers, demonstrating the company's ongoing commitment to protecting the supply chain and high-value assets.
• Increased awareness of the evolving threat landscape through dynamic vulnerability assessments and faster real-time response capabilities.
• Heightened customer trust in the company's business resiliency.

As network perimeters in complex computing environments dissolve, the best defense now lies in adopting offensive strategies. In collaboration with Coalfire and its cloud provider, Thoughtworks has embraced a more offensive security program that encompasses even greater continuous testing, enabling them to more effectively manage their attack surface, safeguard products throughout their lifecycle, and build trust with their customers.