Governance and Risk Consultancy Services Case Study On Web Application Audit

Over View :

The organisation is a premier financial institution of the country with significant presence in the global financial sector, having a huge customer and supplier base for over seven decades.

Challenges :

The client was scheduled to deploy a web application for the department responsible for all the fixed assets of the organisation right from requirement identification stage through the tendering process to procurement and deployment. The client was concerned about the security of web applications as:

the entire database of sensitive information is at serious risk
websites and related web applications must be available 24 x 7 to provide the required service to customers, employees, suppliers and other stakeholders
firewalls and SSL provide no protection against web application hacking, simply because access to the website has to be made public
custom applications are more susceptible to attack because they involve a lesser degree of testing than off-the-shelf software
hackers prefer gaining access to the sensitive data because of the immense pay-offs in selling the data.

Solution :

The solution required a detailed review of:

the functionality of the web application and the associated database
the information security risk with respect to the confidentiality, integrity and availability of the information the web application would process

PCS Consulting, the consulting arm of PCS Technology Ltd. won the contract for Web Application Audit.

The Web Application Audit was completed in 8 days.

Benefits :

The benefits of the web application audit to the client were:

awareness of security loopholes in the web application and database
enhanced information security due to implementation of security controls as per audit recommendations
increased customer and supplier confidence