Annual security audit of a Cooperative Bank’s infrastructure and systems

Client

A Cooperative Bank — a pillar of the local financial system and a thriving institution that has earned the long-standing trust of individual customers and local businesses. In the age of digitalization, the bank focuses on modern access channels (online banking) while placing great emphasis on the security of entrusted funds and personal data.

Challenge

The bank engaged Remote Admin to verify the robustness of its IT systems. The work aimed not only to eliminate the risk of attack but also to prepare the bank for new EU requirements under the DORA Regulation.

Scope of work

• An annual cycle of penetration testing of critical infrastructure, banking systems and mail servers
• Banking application: verification against the OWASP Top 10 standard, business logic, user session and API testing
• Server infrastructure: scanning and manual verification of publicly accessible servers, firewalls and network services for known vulnerabilities (CVEs) and misconfigurations
• Email system: security analysis of mail servers, verification of protections against spoofing of the bank’s domain (SPF, DKIM, DMARC) and resilience testing
• Black-box methodology — simulating an external attack with no knowledge of the configuration, best reflecting real threats from the internet

How the engagement worked

Results and value for the client

Over the year-long engagement, a number of weaknesses were identified that could have served as attack vectors for cybercriminals. In the application, High-severity input validation flaws were found that could lead to unauthorized access to customer data. In the infrastructure, outdated server software with publicly known exploits was identified (Critical findings). In email, gaps in the configuration of domain authentication records were found, which would make it easier for potential attackers to send fraudulent messages (phishing) impersonating the bank. Thanks to rapid reporting, the bank’s IT team steadily eliminated the threats, and re-tests confirmed 100% of fixes were effective. The bank’s management board achieved DORA compliance — the audit and testing were a key element in aligning with the Digital Operational Resilience Act — along with stronger infrastructure security and knowledge transfer: regular reports and consultations raised the client’s IT team’s awareness of modern attack vectors.

The engagement concluded with a letter of reference in which the Bank’s Management Board highlighted the Remote Admin team’s professionalism, flexibility and technical precision.