Keeping security in check
John Verry
Published: 11 Oct 2005 14:30 BST
...rolled off our fax machine.
On Thursday afternoon we were on site for a project kick-off meeting in a conference room with carpeting so deep I dropped my pencil and decided not to bother looking for it.
Dinner and dessert
Judging from some of the titles of the individuals at the kick-off
meeting (chief information security officer, chief information officer,
senior vice-president auditing) , we quickly surmised that their
concerns were of a significant nature. Interestingly, they would not
detail any specific concerns and we spent the better part of the
two-hour meeting discussing their business environment and the critical
role of the application under review. After understanding that the
application we were looking at processed billions of dollars of
transactions on a daily basis, our interest in kicking things off
escalated.
Since the application and supporting systems include interfaces to Federal Reserve Banks, we were advised that we could not begin Penetration Testing until after 6:30PM. We gladly accepted an invitation to grab a bite for dinner with the CISO and some of the other key team members on this project.
At 1845 we were back from dinner.
At 1855 we owned the hosted network. That is, we were the Domain Administrator for all of the hosted devices that encompassed the ASP-hosted solution (including redundant database servers, application servers, Domain Controllers, and gateway router.)
At 1900 we owned the application and the database.
At 1901 we jointly realised that we could transfer $100m+ between accounts with the level of privilege we had achieved. The BC Security Administrator monitoring our activities immediately halted our testing.
At 1910 we were on a conference call with BC's executives to discuss next steps.
I would like to tell you that our rapid success in this engagement was a reflection of the brilliance of our ethical hacking team, but that wouldn't be the truth. Unfortunately, our...
For more, click here...
Previous
Did you find this article useful?
257 out of 520 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
2 comments
