Case Studies For IT Experts
Security Auditing
This section highlights the importance of independent security audits for IT experts and IT security professionals. Many IT departments operate with the innocent belief that hackers will never chose their systems as a target.
The following Case Study illustrate our experience in just how dangerous a carefree approach to IT security can be and the enormous risk companies really do face in the world today.
Case study: When Encryption is Useless.
In our field of business, we often come across cases where IT department employees entirely rely on data encryption. They are persuaded that even in case of a successful hacker attack, information would be well-protected because it was securely encrypted. Unfortunately this is far from reality.
A leading European e-commerce system with a daily turnover reaching one hundred million dollars, relied on a securely encrypted data storage system for maximum security. The database server ran the latest version of Oracle, fields of tables with confidential information were encrypted. The master key was securely stored outside of the database. IT department was careless in paying attention to information security, believing that hackers could not pose any danger or threat to the system, because any encrypted information they did managed to steal would be useless and unexploitable. So, instead of investing in regular penetration tests and security audits, they assigned the entire budget to IT infrastructure development.
As a consequence, hackers easily broke into the system and stayed there, undetected for more than one year. They reconfigured the system in such a manner that all the information - before being encrypted and safely stored - was intercepted and relayed in plain text to a different local database server. Hackers were thus able to invisibly create an almost exact copy of the database, before it was encrypted!
During their presence in the hacked system, they accumulated all confidential information. In the end, they changed administratorsʼ passwords and left mocking messages for the IT team. This unsuspected information leakage led to dramatic financial problems for the company and caused significant IT job cuts.
Solution
In this case High-Tech Bridge security experts will immediately start incident recovery process, followed with careful incident forensics.
As the compromised system is restored and hackers are identified, - general IT security audit with source code review should be performed. Upon completion High-Tech Bridge's certified security experts will make a penetration test in order to complete the verification of the systems security and reliability.
Please contact High-Tech Bridge or request a call back to define working conditions and start any of the mentioned above steps.
