Project Insight

Case Study: Information System Development Security Consulting for Financial Institution A

Certification Consulting, Project Insight / /

Client: Financial Institution A (a first-tier financial company)Project period: Carried out for about six months in 2013 Project background and subjectThe client, a first-tier financial institution, is required under the Regulation on Supervision of Electronic Financial Transactions to conduct a security review when developing or building an information system. Because the newly developed information system

Security Solution Vulnerability Assessment Case for Company A

Certification Consulting, Project Insight / /

Client: Financial Company A (financial company)Project Period: 2012, 1 month Project Background and TopicIn line with its information security implementation plan, Financial Company A carried out projects to deploy several security solutions, including a DB access control solution. Under the financial supervisory regulations, every security solution that is introduced must have obtained CC certification. One

USEFUL TOOLS FOR APPLICATION SOURCE CODE REVIEW

Certification Consulting, Project Insight / /

Most of the application source vulnerability diagnoses will receive a large number of source files and perform vulnerability diagnostics. Most of them are static diagnosis using a tool for diagnosing source vulnerabilities such as Fortify and dynamic manual diagnosis of a professional consultant. In this situation, it is common to utilize some useful tools because

Case Study: Annual Vulnerability Assessment and Security Consulting for Evaluation Institute A

Certification Consulting, Project Insight / /

Client: Evaluation Institute A (Business type: public institution)Project period: Carried out for one year in 2013 Project background and subjectMost public institutions are in a position of being supervised by multiple higher-level agencies, and they also have difficulty securing information security budgets. The client, Evaluation Institute A, is likewise supervised by the National Intelligence Service

Firewall Policy Optimization Consulting Case for Financial Firm A

Certification Consulting, Project Insight / /

Client: Financial Firm A (financial industry)Project Period: Performed over about 2 months in 2013 Project Background and TopicFinancial Firm A was performing technical vulnerability assessments at least twice a year. Each time, in addition to the regular vulnerability assessment, it selected one topic for an in-depth assessment. The in-depth topic for that year was optimization

Case of Privilege Gain Through a Change-Management Weakness in the Edge Router ACL Configuration

BLOG, Certification Consulting, Project Insight / /

1. Assessment Overview The attacker is located outside the Internet, and the targets are systems located in the DMZ.This penetration-test assessment is a scenario that attempts to gain privileges on systems located in the DMZ, and a pivoting attack is possible.The DMZ operates DNS, Web, and Mail servers, and a router located at the outermost edge

Pre-consulting Case for Public Institution A in Preparation for an Information Security Status Assessment

Certification Consulting, Project Insight / /

Client: Public Corporation A (public institution)Project duration: Conducted over one month in 2014; achieved an assessment result about 15 points higher than the previous year Project background and subjectThe client became an institution subject to the on-site assessment of the National Intelligence Service’s annual information security status assessment, and the previous year’s assessment result was

Master Plan (ISP) Consulting Case for Government-Funded Institute A

Certification Consulting, Project Insight / /

Client: Government-Funded Institute A (category: public institution)Project Period: Performed over 2 months in 2013 Project Background and TopicThe client is a government-funded institute. While under regular supervision by higher authorities, including the National Intelligence Service information security status assessment, the absence of a mid- to long-term information security plan was pointed out.In addition to the