My Recent Engagements
Case Study
Improving Bank’s Security Posture Through Security Testing.
A global bank underwent a series of assessments to verify the effectiveness of security controls on its payment servers.
Project Background
ICICI Bank is India's largest private sector bank, with a presence in 17 countries, including Singapore. ICICI Bank offers corporate and retail customers a wide range of banking products and financial services. ICICI requested Pragma to conduct a vulnerability and penetration testing assessment of the FAST payment servers hosted in Singapore and to provide a report on the vulnerabilities found and the associated risks.
This assessment's purpose was to verify the effectiveness of ICICI's security controls to secure business-critical information. ICICI's internal networks, including systems and applications, are important as they are used to process FAST payments. If accessed inappropriately, they could cause reputational damage and financial loss to ICICI and its management.
The Project
The nature of the testing performed was designed to replicate the threat of an attacker wishing to gain access to ICICI computer systems or data through an unknown weakness in the systems and security mechanisms in place. To test ICICI's ability to defend against direct attack, Pragma executed a comprehensive network vulnerability scan using Rapid 7 insightVM, exploiting weakened services, client-side attacks, and server-side attacks.
The Results
The report represented the findings from the assessment and the associated remediation recommendations to help ICICI strengthen its security posture. Pragma identified various issues, a few of which should be considered for remediation according to ICICI bank risk and patch management processes. If desired, a few issues could be remediated, but they do not represent a vulnerability.
Case Study
Providing a Fintech with Technical Support in Compliance with the Monetary Authority of Singapore (MAS) Technology Risk Management
Pragma signed up with the client as they needed a partner with expertise in technology risk and cybersecurity to support them in achieving the MAS license.
Project Background
The client provides an asset tokenisation and investment management platform where investors can easily access and invest safely and transparently in asset-backed security tokens.
The client's operations fall under the MAS regulatory requirements. To continue its operations and provide a safe platform for its customers, the Client must hold a capital markets services (CMS) licence to conduct activities regulated under the Securities and Futures Act and comply with MAS Technology Risk Management and MAS Notice 655 Cyber Hygiene.
The client required a partner with expertise in technology risk and cybersecurity to support them in achieving the MAS licence.
The Project
Given the size and complexity of the project, Pragma worked closely with the client to understand the scope and resources needed. The first scope involved compliance implementation with MAS TRM and MAS Notice 655 Cyber Hygiene. Pragma's team produced and implemented policies, documents, and checklists to support client compliance.
Pragma then assisted in reviewing and fulfilling the required MAS CMS licence application forms and liaised with the authorities from the MAS on any queries during the application.
Pragma's security specialists performed penetration tests and vulnerability assessments to ensure the platform was resilient against cyber threats. Pragma also performed a mobile application security test to identify vulnerabilities and a source code review to identify any vulnerabilities in the application code.
The Results
The client met the regulatory requirements and achieved the MAS license and increased its customer base by providing a functional and secure platform.
With the licence, the client can now provide real estate investment models for asset owners and investors by issuing asset-backed security tokens for fractional ownership in a regulated environment and is one of the first platforms to do so.
Case Study
Identity Access Management Implementation
The client sought Pragma’s services to improve security posture and comply with FIEA and PIPA.
Project Background
Mizuho Bank, Ltd. is a Japanese banking and financial services company headquartered in Tokyo, Japan. Mizuho Bank approached Pragma to help them implement an identity access management (IAM) solution to enhance their security posture. After evaluating their needs and requirements, we recommended SailPoint.
This industry-leading IAM solution would meet their needs and comprehensively solve their identity and access management challenges. Mizuho Bank faced several challenges managing identities and access across their systems and applications. They needed a solution that could provide a centralised view of identities and access, streamline access requests and approvals, and provide granular control over access to sensitive resources. They also needed to ensure they complied with regulatory requirements such as the Financial Instruments and Exchange Act (FIEA) and the Personal Information Protection Act (PIPA).
The Project
Our team worked with Mizuho Bank to implement SailPoint IdentityIQ, a comprehensive IAM solution to help them meet their objectives. We started by analysing their current environment and identifying their identity and access management challenges. Based on our assessment, we designed and implemented a solution that included the following components:
1. Identity Governance: We implemented SailPoint's Identity Governance module to give Mizuho Bank a centralised view of identities and access across their systems and applications. This module allowed them to streamline access requests and approvals, enforce separation of duties (SoD), and provide granular control over access to sensitive resources.
2. Access Management: We implemented SailPoint's Access Management module to provide Mizuho Bank with a single sign-on (SSO) solution that would simplify access to their applications and systems. This module also provided multifactor authentication (MFA) capabilities to enhance the security of their access controls.
3. Compliance Management: We implemented SailPoint's Compliance Management module to help Mizuho Bank comply with regulatory requirements such as the FIEA and PIPA. This module provided automated workflows to manage access certifications and ensure appropriate and compliant access.
The Results
Our implementation of SailPoint IdentityIQ has helped Mizuho Bank improve its security posture and enhance its identity and access management capabilities. The solution has provided them with a centralised view of identities and access, streamlined access requests and approvals, and provided granular control over access to sensitive resources. The SSO and MFA capabilities have improved the user experience while enhancing security, and the compliance management capabilities have helped them ensure compliance with regulatory requirements.
Case Study
Investigating a Cybersecurity Breach for a Sports Equipment Retailer
The company engaged Pragma to investigate the cybersecurity breach on their systems.
Project Background
The sports apparel company is one of Australia's largest winter sports equipment retailers. It is the destination for all the best skiing, snowboarding and outdoor sports brands. Founded in 1985, the company operates a website that generates 20% of its gross revenue.
During one of its routine checks, the sports apparel company discovered a password-stealing Trojan on its website. Kaspersky Labs verified the detection to be a true positive; however, their web host could not detect and remove the infection. Shortly after the detection, The sports apparel company received reports that their customers’ credit card details were being mined.
The Project
The sports apparel company engaged Pragma to investigate the cybersecurity breach on their systems. Pragma discovered that the website is extremely vulnerable to SQLi and other attacks due to obsolete backend software and operating system deployment.
As the site has been attacked multiple times and contains notable security vulnerabilities in the hosted platform, Pragma agreed with the client and their insurers to temporarily host the platform on Pragma’s CloudControl platform, which includes security monitoring, network security and Distributed Denial Of Service (“DDOS”) protection.
The Results
Pragma eradicated all traces of the malware and upgraded various components of their website. As part of the migration to the CloudControl platform, Pragma reviewed the client’s system architecture and identified and patched a vulnerable component to SQL injection (“SQLi”).
During the month the website was hosted on Pragma’s CloudControl platform, 7,829 threats were blocked, including 116 further SQLi attempts. The increased network security rejected all these attacks. The website is now stable and threat-free.