Case Study of Cyber Security in E-Commerce Company

Cyber Security in E-Commerce Industry

Our client, a well-known ecommerce company, had been alerted by their internal tech team of their web applications being attacked several times in a row. The challenge was not only knowing whether the hack was from an internal source, but also how vulnerable was their infrastructure to such attacks.

Solution

As soon as we were approached, our first step was to re-check the logs and sure enough, we found they were being accessed by someone outside their network. What we also found was that there was not any specific pattern to these attacks; they were being targeted from different IPs and from different signatures. The attacks were found to be random.

This is when we decided to Red team the firm; in other words, we went on an offensive security testing - a full-blown multi-layered attack - to measure how well this firm’s physical security controls, computer networks, and software applications could withstand an attack from any hacker. It led us to understand how their network was being exploited to get further access to their data. We identified many vulnerabilities in the process, and finally submitted to them a proper compliance report as per the prevalent international standards.

Next, we undertook another task - a more important and a more difficult one. This step was to provide as much support as we could to their in-house app development team in preventing and mitigating any system vulnerabilities. Our goal was to not just set up, but also get these employees well acquainted with organizational cyber security concepts, such as setting up an incident response plan, web application firewall, CSP, server-side security, and database-level security. In addition, we held workshops to train them in how to create hack-proof applications; we even certified the applications thus created by them.

Outcome

By identifying vulnerabilities and weaknesses in the firm’s security by using advanced attack techniques, Cyber Octet helped in :

• Reducing risk exposure for the client.
• Recommending solutions with tested techniques to further improve security.
• Suggesting cost-effective risk-mitigation measures based on their specific business requirements to ensure security as well as business continuity.
• Providing the much-needed training to the in-house developers to ensure any potential risk to the security infrastructure is at best, prevented, and at worst, identified and dealt with, before it has a dire impact on the overall business.