Financial Services

For over a decade, Positive Technologies has been conducting security and compliance assessments for dozens of leading banks around the world, giving us unique insights into the practical challenges involved in securing these types of systems.

Our security researchers are continually in the field learning about the latest threats and banking systems in order to keep our customers ahead of emerging dangers.

Our security specialties provide in-depth analysis to financial organizations including penetration testing, development of CBS hardening guides, secure software development lifecycle (SSDL) consulting, and security and compliance assessments of ATMs, POS terminals, banking applications, and even SAP.

Our comprehensive approach to security for banks and other financial institutions includes:

• Penetration testing:
  • Identifying existing vulnerabilities, showing ways to exploit them, and measuring your staff’s level of security awareness to demonstrate how hackers could circumvent your existing security mechanisms or persuade users to sidestep security policies
• Online banking security assessments:
  • Gray-box web application security testing for online banking system analysis from the perspective of an intruder with no access to the application (no user-level access)
  • White-box web application security testing including analysis of web application source code and architectures
• ATM security assessments:
  • Preliminary ATM audit to obtain general information on the system, analyze the main system components, identify hardware and software versions, test network communications and protocols, and scan for vulnerabilities
  • Security assessment of ATM hardware and software components includes finding known and zero-day vulnerabilities and developing exploit tools to verify vulnerabilities and demonstrate possible attacks
• SSDL сonsulting:
  • Our Secure Software Development Lifecycle (SSDL) consulting service helps organizations introduce the procedures necessary for secure application development, including infosec training, security policy and risk assessment development, how to write secure code, code review and audit methods, deployment, and incident response