National Payments Gateway Hardening

The client operated a national payment switch that had grown organically for a decade. Our brief was to establish whether it could withstand a determined attacker, and to fix what it could not.

Approach

We ran a full threat model against the switch and its administrative interfaces, followed by authenticated and unauthenticated penetration testing of every exposed component.

Outcome

• Fourteen findings, three of them critical, all remediated within the engagement
• Administrative access reduced from 40 accounts to 6 with break-glass procedures
• Continuous monitoring deployed across the transaction path