Keeping security in check

• Tags:
• Ethical Hacking

John Verry

Published: 11 Oct 2005 14:30 BST

• 
• 
• 
• 
• 

Ethical hacking is one of the most intriguing and exciting elements of our work at Pivot Point Security. A recent engagement for an International Bank took us a bit by surprise as the level of security provided by an Application Service Provider (ASP) to protect the identities of the banks clients and hundreds of millions of dollars was notably less than one would expect. I'll show you the techniques that we used and how our efforts turned from hacking their critical application, to hacking the Application Service Provider, to hacking another bank's hosted network.

A call to arms
On a Monday morning in the not-too-distant past, we received a call from an Information Security engineer at a major international bank, who we will refer to as Bank Client (BC) from this point forward. An industry colleague that frequently worked with us in support of our projects (and vice versa) on network and security architecture referenced them to us. This was not a typical introductory call to vet our capabilities; this was a call to engage our services.

"We have a few concerns regarding the security of an application that is hosted by a third party on our behalf. How soon can you come on site and perform an ethical hack against the application?" he queried. Still surprised by the directness of the call, I offered, "I think we could get resources on site early next week."

He replied: "We were really hoping that we could get this done no later than the end of the week" reinforced the urgency of the call.

"If it's that important I think we can move some personnel around and get there on Thursday," I said quietly as I prayed that I wouldn't take too much grief from our project manager for reallocating his resources, but it's not every day that an opportunity this intriguing rears its head.

"OK, let me confirm everything with our management," he said. "We'll be in touch, shortly."

On Tuesday morning a signed purchase order...

For more, click here...

• 
• 
• 
• 

• Share this article:
• Digg
• Slashdot
• Del.ici.ous
• Stumble
• Reddit

• Most Recent
• Most Popular
• Most Discussed