Description
Client: Vistra
Category: Product Security
Date: 28 April 2023
Client Background
Vistra is a well-known service provider with a functional reach in many places all over the world. Through fund administration and other corporate services, the company is committed to assisting businesses in improving. By offering support for hiring additional employees, entering new markets, and increasing productivity, it aids its clients in accelerating their growth. In general, it aids businesses in structuring their operations more effectively.
Before they met us
Vistra helps companies to structure their business more efficiently by allowing them to improve through its fund administration and other corporate services.
- Vistra’s Cloud environment was showing signs of potential security issues.
- We needed to hit the vulnerabilities and determine their impacts.
- The main objective of the cloud was to secure the cloud infrastructure to avoid any unwanted incidents.
How We Addressed the Problem?
- For the client's cloud environment, we carefully developed a vulnerability assessment and penetration testing approach.
- Our team gathered all the data required to address the problems obstructing Vistra's operations.
- To evaluate the effects of each vulnerability and offer solutions, we conducted thorough penetration testing.
Methodologies Used
- CSPM, SSPM, OSSTMM and PTES,
- Standards like NIST and ISSAF
- Preparing a Security Audit Report (SAR)
Tools used
AWS CLI: to manage and automate AWS resources
Prowler: to audit AWS configurations.
AWS Consoler: to navigate and interact with the client’s AWS infrastructure.
AWSENUM: for enumerating AWS resources
Scout suite: to scan for misconfigurations, vulnerabilities, and compliance issues.
Results and Recommendations
Vistra’s cloud environment was loaded with vulnerabilities having the potential to completely take down its infrastructure.
They were not in line with the necessary cloud security and compliance requirements.
We delivered them a complete list of vulnerabilities with their impacts. Plus, we suggested Input Validation and Logout implementation.
We did a complete review of their security policies and controls and provided recommendations to eliminate vulnerabilities.
