Situation
A financial technology organization enlisted NCC Group’s support to provide pen testing services and ensure continued security by identifying vulnerabilities and security risks.
The organization’s applications and services are used by more than 9,000 businesses of all sizes, including many that operate within the finance industry.
Given the sensitivity of the information handled by the organization, it’s imperative that their services are able to withstand potential attacks, as well as have a broad awareness of the potential attack vectors that attackers may use to access this information.
NCC Group identified risks by utilizing a combination of pen testing, threat monitoring, and vulnerability assessments.
At a Glance
Organization: Fintech Organization
Industry: Financial Technology
Challenge: NCC Group was approached by the company to provide an independent program of security assessments to focus on the vulnerabilities and security risks present in their global footprint
Solution: NCC Group identified potential vulnerabilities within systems, along with company employees who could be targeted for social engineering activities or impersonation
Result: Penetration testing determined the vulnerability of the organization's assets, OS fingerprinting, and open ports on the assets. This also included identifying employee information being unintentionally available in the public domain.
Challenge
The organization has a global presence and is headquartered in Australia; and initially approached NCC Group’s APAC team to provide pen testing support before rolling this out worldwide.
After operating for more than 20 years, the organization had developed a large internet presence along with a portfolio of acquired products and needed support ensuring that their large number of registered domains were not open to potential attacks, particularly given that some of them were no longer in use.
Given the continued focus that attackers had been placing on the financial and fintech sectors, the client wanted to fully understand their susceptibility to attacks as well as the robustness of their countermeasures.
Solution
Following a series of successful penetration testing and other assessments, the client had reached a point where they were confident in their ability to mitigate potential threats. However, given the evolving nature of cyber security, the client also requested that NCC Group provide them with threat intelligence services to stay ahead of the curve and better understand when they may be most susceptible to potential threats.
NCC Group monitored several domains, including those on the dark web, for any leaks of particularly sensitive information or information that may be related to the client’s services and applications. This included:
Physical Locations - Full addresses of the buildings that the company owns and operates from
Physical Security - Information about the location of cameras, gates, fences, and backdoors, etc., that can be found online in places such as Google maps
Relationships - Information about partners, customers, suppliers, and third parties that can be used to create social engineering scenarios to help understand the business structure
Metadata - Usernames, internal network locations, emails, versions of software, geolocation, and other metadata about the company
Technologies - Support forums, mailing lists, and other online sources can reveal the technologies in place and can allow the fingerprinting of defensive solutions such as firewalls and email filtering solutions
Result
In addition to the continued deployment of penetration testing services that NCC Group was providing to the client on a global scale, the client has also been provided with a comprehensive threat intelligence report which outlines the most prevalent threats to the organization and its associated services and applications.
A full report was provided to the client detailing the information gathered and the associated risks and exposing any potential attacks or information leaks to be aware of. It contained recommendations for mitigating any problems found and limiting online exposure of sensitive information.
NCC Group exists to make the world safer and more secure.
As global experts in cyber security and risk mitigation, NCC Group is trusted by over 14,000 customers worldwide to protect their most critical assets from the ever-changing threat landscape.
Get Started on Your Cyber Security Journey
Our experts are ready to help you stay ahead in a constantly changing threat landscape. Contact us today to learn more about what NCC Group can do for your organization's unique cybersecurity needs.