As per the Central Bank's standards, the bank was required to regularly report on its infrastructure security level and the measures taken to protect confidential information. Which was why it decided to hold a tender for pen test services in the latter half of 2023.
Under the tender terms, the customer asked the bidders to carry out a series of penetration tests from outside and inside the corporate network, analyze the security of the bank's web and mobile applications, and then prepare a report on the work's results, containing detailed information on the threats and vulnerabilities identified and compliant with the risk assessment criteria developed by the bank.
ICL Services completed the task better than all other bidders, and was subsequently assigned the project.Key Challenges
- Carry out a series of pen tests from both outside and inside the bank's corporate perimeter
- Rank the vulnerabilities identified by risk level and provide recommendations for enhancing the corporate IT resource security
- Deliver a final report in line with the customer's standards
Implemented our solution
The team started work in November 2023. The project deadlines were very tight - the customer needed ICL Services to complete the main series of tests by mid-December.
The customer emphasized three pentest aspects:
— firstly, the boundaries for penetration testing had to be strictly coordinated with the security service,
— secondly, there was a strictly defined procedure for which tests we were supposed carry out and which devices our experts were supposed to use,
— thirdly, the risk assessment of the vulnerabilities identified and recommendations for fixing them had to be consolidated into a report in accordance with the customer's internal standards.For example, protecting bank secrecy and confidential payment information was considered a top priority for fixing vulnerabilities - relevant issues were to be given the highest level of urgency and needed to be addressed with security measures immediately.
This, however, was not an obstacle for our team. ICL Services employees worked constructively together with the customer's company experts to streamline report formatting. It was also crucial to complete the main tasks before the winter holidays, when it would be more challenging to work full-time.
After agreeing on project deadlines, the experts initiated two parallel processes: they simulated an external attack on the bank's perimeter and visited the customer's office for pentests within the corporate environment.
From mid-November through late December 2023, the team investigated and scanned for vulnerabilities, including — at the customer's request — those that would allow for system privilege escalation or compromise the systems. Additionally, we identified potential attack vectors and tested the terminal infrastructure. In total, the pen tests covered about 200 internal endpoints (including servers and network devices) and about 50 external nodes.
From mid-December, after systematizing all the threats and vulnerabilities that we had discovered, identifying potential attack vectors, and developing recommendations to enhance corporate infrastructure security, our team began working on the final report, completing it on time
We classified risks according to the customer's criteria, which helped us set priorities for our proposals regarding system protection and corporate resource security enhancement - the proposed measures
were categorized into immediate, medium-term, and long-term (strategic).
Products and technologies
- nmap
- Nessus / Greenbone
- Metasploit framework
- Mimikatz
- During the work, other well-known vulnerability scanners, traffic analysis tools and tools were also used, including those created during the work. Full list disclosed for security reasons.
Results
- More than 250 external and internal endpoints were tested, including simulated attacks from outside the customer's infrastructure.
- Once identified, the vulnerabilities were categorized by risk level: high (17.8%), above average (3.5%), average (21.4%), below average (35.7%), and low (21.4%), as per the customer's criteria.
- The final report was developed in accordance with the bank’s internal standards.
- For each group of vulnerabilities, we gave recommendations on how to improve the IT and corporate resource security level.
Services provided
Expert on implementing and supporting information security solutions