The Challenge
The bank developed an application for a new market and required penetration testing to reduce financial and reputational risks.
- Financial industry is the 2nd most attacked sector; digital nature of fintech and neobanking heightens cyberattack risks.
- In the new market where the client’s reputation is particularly weak, the need for top-tier security becomes essential.
- Expert penetration testing was crucial to maintain business integrity.
Client sought a provider with experience in financial application testing and unique threat intelligence access.
The goals of this testing included:
- Identifying potential concerns with the applications and external networks in their current state.
- Assessing how far an attacker with specific skills and motivation could breach the system.
The Solution
For their penetration testing, the client chose the BlackBox penetration testing method.
FS Group team conducted the testing in the production environment, simulating an external attacker with no prior knowledge of the target infrastructure.
The process of penetration testing consisted of the following steps:
- Collecting information from the client
- Clarifying the testing goals
- Discussing Rules of Engagement
- Conducting a study on the goals
- Conducting automated checks
- Performing manual checks and analyzing the results
- Investigating detected vulnerabilities to determine exploitation methods and developing attack software
- Preparing a report and recommendations for eliminating identified vulnerabilities
Result
FS Group discovered 2 critical, 4 high, 13 medium, and 10 low-risk vulnerabilities.
- The overall risk level was categorized as high.
- FS Group prevented a potential financial loss of tens of millions of dollars by discovering the critical and high-severity flaws. This financial loss would include reputational damage, regulatory fines and penalties, loss of consumers, and a high probability of business disruption and permanent closure.
- The client was provided with a detailed pentest results report that consists of:
- Testing results summary and ranking issues by risk level
- Detailed findings for the common scope, as well as for Android and iOS applications separately
- Recommendations on how to mitigate each vulnerability
is the average total cost of a data breach in the financial industry worldwide.
are the costs of a data breach at companies with more proactive and risk-based vulnerability management, such as vulnerability testing, penetration testing, or red teaming.
