The specific scope of the penetration test conducted for the international insurance company was to simulate a targeted attack by a malicious actor with the motivation to:

Determine if remote attackers could penetrate the company's defenses.
Identify potential security breaches and their impact.

The main goal of this penetration test was an examination of the client's infrastructure through the third party for possible issues that could affect the security of the applications, infrastructure and privacy of its users. The assessment also checks and evaluates security configurations that ensure the confidentiality, integrity, and availability of the client's company sensitive data and other resources.

During 35 days of extensive penetration testing and assessment, our team identified 46 vulnerabilities, with the highest severity being Critical. The identified vulnerabilities span across several categories such as sensitive data exposure, missing authorization, outdated software versions, and more.

For each vulnerability found, we gave recommendations for their mitigation in the report. Here are some examples:

Review and update the server's access control and authentication mechanisms to ensure that only authorized users can access sensitive data.
Implement encryption for data at rest and in transit to protect sensitive information from unauthorized access.
Perform regular security assessments and vulnerability scans to identify and mitigate potential security issues.

Regularly update and patch the server's operating system, Apache, and any associated software to address known vulnerabilities.
Regularly conduct employee security awareness training, including the importance of password hygiene and recognizing social engineering attacks.
Enable multi-factor authentication (MFA) for critical systems and applications to add an extra layer of security.

Notify affected employees and instruct them to change their passwords immediately if they use any of them on the Internet.
Implement strong password policies and enforce the use of unique, complex passwords for each employee.

ESKA Security

Write a review for ESKA Security

Please fill the form below

Budget

Quality

Schedule

Communication