Client: Eight companies of Financial Group A (financial enterprises)Project Duration– Seven financial affiliates — carried out over six months in 2011; ISO27001 and BS10012 certifications obtained– One additional financial affiliate — carried out over 2.5 months in 2012; ISO27001 and BS10012 certifications obtained Project Background and SubjectIn line with the financial group’s policy of achieving
Client: App and content platform A (operation of a marketplace for games and apps, mobile commerce, e-books, and video content)Project duration2016: one year of initial-audit consulting; ISMS certification obtained2017: eight months of surveillance-audit (first) consulting2018: six months of surveillance-audit (second) consulting Project background and subjectThe client spun off from its parent company in 2016 and
Client: Financial Institution A (a first-tier financial company)Project period: Carried out for about six months in 2013 Project background and subjectThe client, a first-tier financial institution, is required under the Regulation on Supervision of Electronic Financial Transactions to conduct a security review when developing or building an information system. Because the newly developed information system
Client: Financial Company A (financial company)Project Period: 2012, 1 month Project Background and TopicIn line with its information security implementation plan, Financial Company A carried out projects to deploy several security solutions, including a DB access control solution. Under the financial supervisory regulations, every security solution that is introduced must have obtained CC certification. One
Most of the application source vulnerability diagnoses will receive a large number of source files and perform vulnerability diagnostics. Most of them are static diagnosis using a tool for diagnosing source vulnerabilities such as Fortify and dynamic manual diagnosis of a professional consultant. In this situation, it is common to utilize some useful tools because
Client: Evaluation Institute A (Business type: public institution)Project period: Carried out for one year in 2013 Project background and subjectMost public institutions are in a position of being supervised by multiple higher-level agencies, and they also have difficulty securing information security budgets. The client, Evaluation Institute A, is likewise supervised by the National Intelligence Service
Client: Financial Firm A (financial industry)Project Period: Performed over about 2 months in 2013 Project Background and TopicFinancial Firm A was performing technical vulnerability assessments at least twice a year. Each time, in addition to the regular vulnerability assessment, it selected one topic for an in-depth assessment. The in-depth topic for that year was optimization
1. Assessment Overview The attacker is located outside the Internet, and the targets are systems located in the DMZ.This penetration-test assessment is a scenario that attempts to gain privileges on systems located in the DMZ, and a pivoting attack is possible.The DMZ operates DNS, Web, and Mail servers, and a router located at the outermost edge
SUMMARY VPN has various methods such as remote access from site-to-site. However, from the viewpoint of an attacker, it is an attractive hacking object that can penetrate into an important path to enter an internal network only if a VPN is penetrated. Actually, site: vpn. * Com is a lot of domestic sites starting with vpn
Client: Public Corporation A (public institution)Project duration: Conducted over one month in 2014; achieved an assessment result about 15 points higher than the previous year Project background and subjectThe client became an institution subject to the on-site assessment of the National Intelligence Service’s annual information security status assessment, and the previous year’s assessment result was