Case Studies

TrustCC has performed security assessments for organizations ranging in assets from less than $2 million more than $93 billion. Our methodology has proven successful in penetrating security defenses in more than 75% of the organizations for which we perform this type of service. Below are descriptions of a few highlights from clients we have served.

Penetration Testing
The internal audit department at a very large financial institution was concerned about actual risk exposure to their internal environment. The IT security department which is an entirely separate division of the company had engaged a national firm in prior years to conduct their security assessments, but leaders of the internal audit division questioned the thoroughness of the assessments and sought a professional firm with enough expertise to determine if the past assessments were accurate... Read More

Social Engineering and Phishing
A regional financial institution was concerned about the effectiveness of their information security awareness training. The organization had appropriate policies and procedures which employees were required to read and sign each year. They held monthly staff meetings and information security was always a topic of discussion. Emails were sent on a regular basis to all employees which discussed recent security issues in the news and they had placed posters with information security messages in strategic locations such as break rooms. The organization however, had no way of determining the effectiveness of their well thought out program... Read More

Outsourced IT Audit
For years, a large financial institution had been using internal resources to perform IT audit functions. This was an ideal arrangement for some time until the environment became so complex with multiple systems, network architectures, and security controls that it became impractical to maintain enough internal expertise to effectively perform the required audits... Read More

Policy Development
An organization had recently been heavily cited by financial institution regulators over their lack of organization and maintenance of their information security policies. The organization had policies in a binder, on an internal web site, and various other locations with no discernable rhyme or reason. The policies were often conflicting and organizational management was unable to discern which polices were current and which were outdated... Read More