Case Studies - Security

Where we came in
Our Security Health Check team works with many government departments, and a string of blue chip industry clients in every industrial and commercial sector. They're all security-cleared for MoD purposes and comply with the highest levels of security policy. And it's a strict policy that we do not employ former hackers.

So a routine UK-based security check for a particular blue-chip client was nothing out of the ordinary. But it very quickly turned into an extraordinarily serious global issue.

As our experts did routine testing on our client's UK intranet, they found they could access the company's site around the world. This was a wake-up call for the company, who asked us to look at the hacking threats they were exposed to, and how to deal with them.

What we did
Throughout the investigation, the company watched 'over our shoulder', so they see at first hand how an infiltrator might try to attack their systems.

We began by dialling into the company's telephone network outside office hours, to see how many 'rogue' computer modems were live on the system. In one week we found more than 80 - without a single member of staff realising that we were doing these checks.

Armed with just open-source information and the few potential 'back doors' that we had found in the system, our second phase highlighted a number of routes into the client's data networks. Within days, we had control of their UK network. Within a week, we had complete control of their global network, which covered more than 15 different sites.

To find out how easy it would be for a member of staff to access sensitive information, we identified every place the company might be vulnerable: from coding to cabling.

Finally, we checked the company voice networks - the entire PABX system, call centres, call loggers, voicemail systems, physical security, document control systems, classified telephone services and all the operating procedures.

The results and benefits
We produced a detailed report of the systems' vulnerabilities, with our recommendations for improving security. Everything is now back to normal - secure and under control. And because of the process, the company has much more in-house expertise to prevent it happening again.

Anything is possible - just ask
This project is a prime example of how our IT health checks deal with existing problems and find ways to protect systems for the future.

We could do the same for you. Whatever your requirements or problems, we have the ideas, know-how and solutions.