In-depth IT Security Vulnerability Assessment For Major Law Firm
BUSINESS CHALLENGE
Our client, a large international law firm, needed an in-depth security vulnerability assessment for one of their clients. The scope of the assessment was to examine and assess the risk of a cyber-attack to a mission-critical system. They turned to SMAC Apps, their trusted IT advisor, to perform this assessment and provide recommendations for improving security.
SMAC Apps’s SOLUTION
The vulnerability assessment consisted of several parallel workstreams:
- Device scanning
- Application penetration testing
- Infrastructure assessment (firewalls, servers, operating systems, and the intrusion detection system)
The SMAC Apps team also examined existing security policies and procedures, server log files, backups and restore processes, data protection (at Rest, in Use, in Motion), and change management procedures.
The SMAC Apps team found issues of varying severity in many areas: policy gaps, missing controls, and vulnerable software versions were discovered. SMAC Apps assessed and categorized each issue. The client was immediately notified of all critical issues and was provided with a recommendation to remediate or minimize the risk of vulnerability.
SMAC Apps compiled the results of the assessment into a detailed report. The report was structured to cater to the needs of both senior business and technical leadership. The report described the testing performed, the tools used, the expected results, the actual results, vulnerabilities, and their severity level, and recommendations for tightening security to remediate vulnerabilities and reduce overall risk.
BUSINESS BENEFITS
The assessment provided our client with a comprehensive security evaluation of the infrastructure and the application, enabling them to present a road map of recommended security improvements to their client. The client was pleased with the thoroughness of the evaluation and awarded SMAC Apps an additional contract to implement several of the security recommendations, which will provide better defense again intrusion and a stronger cybersecurity structure.
