Case Studies — Tested Where It Hurts
Redacted but real. 5 sector-critical cases — SCADA/OT, BI SNAP, QRIS, AS/400 core & BI-FAST — each tested under CREST + ISO 27001:2022, 10-day board report, retest included before audit window.
OJK/BI · ISO 27001 · SOC 2 · PCI DSS 4.0 · IEC 62443 · OWASP ASVS/MASVS/API Top 10 — mapped per finding
SCADA/OT Penetration Testing
IT→OT pivot to PLC/HMI — historian creds, jump-host bypass, vendor VPN. Lab-replicated, zero outage. IEC 62443, 100% High closed at retest.
BI SNAP API
27 SNAP endpoints — BOLA fund diversion + signature replay. 1 critical chain, fixed in 4 days, QSA/OJK accepted first time.
Mobile Banking QRIS Module
Static MPM QR reprint + SDK key MITM. HMAC-signed dynamic QR + pinning, 100% critical closed, BI QRIS passed.
AS/400 Core Banking (IBM i)
*ALLOBJ → DB2 direct UPDATE via ODBC, TN5250 hijack, QSECOFR. Vaulted + TLS + ACL, 100% critical closed in 48h.
BI-FAST Payment Module
Proxy alias hijack + double-credit via missing idempotency. OTP-verified proxy + HMAC callback, BI certified first time.
Punya Modul Serupa?
Scoping 90-menit gratis · NDA · 10-day board report · Retest included · Per-module pricing
Request Case Study Proposal Explore Banking Security →