Testing banks before an attacker does

The situation#

A bank's systems are attacked for a living, and a regulator expects it to know how they would fail before anyone else finds out. For two years I did that finding out at EY, in a cybersecurity team whose clients were mostly Belgian financial institutions. The engagements were confidential, which is why no client is named here.

What I did#

The core of it was penetration testing: more than twenty tests, each one an agreed attempt to break into an application or a network, written up as the findings and how to close them.

Some assignments went further. On red team work the target was the whole organisation rather than one system, approached the way a real attacker would. On blue team work I was on the other side, helping the defenders see and stop that kind of attack.

The rest was compliance: auditing how an institution met the rules it answers to, among them GDPR and PSD2, and writing the recommendations that would close the gaps.

What it means for an audit now#

An audit from avanserv starts from the attacker's side, because that is where I learned to look. A finding says how it would be exploited and what leaving it costs, so the fixes can be ranked by risk rather than by how long the list is.