CASE STUDIES

Responded to potential insider threat from IT administrator and other IT team members resulting in a multi-phase remediation plan to address personnel, process, and technology issues.

​

​

​

​

Completed last minute pre-production security and code review that uncovered significant issues with front-end Angular UI and back-end .Net API.  Embedded with the development team providing technical leadership, oversight, and execution. Addressed code quality and security issues resulting in a high-quality release to their client.

Discovered a critical vulnerability in a state's law enforcement system used by almost 300 agencies which allowed attackers to bypass authentication and view/change data.  Immediately reported the issue to the state's cyber command group and validated the patch was deployed successfully to our client's police department.

​

Responded to high priority phishing / social engineering attack, including bank account compromise, of IT administrator resulting in immediately resolving certain critical vulnerabilities.

​

​

​

​

​

Discovered and accessed surveillance systems and security cameras without being told where they were on the network or being given any credentials to access them.

Responded to high priority product assessment prior to hardware going to manufacturing resulting in several key immediate improvements and a go-forward plan for significant architecture changes in both hardware and the client’s cloud.

Identified vulnerable internet-facing applications and services that have not been updated to the latest versions (which poses a security risk since updates often include security patches).

Demonstrated that employees with administrative access are not using strong enough passwords or multi-factor authentication by discovering hashes and cracking them.

Discovered a critical vulnerability in a popular gaming commission licensing portal used by many tribes which allowed an attacker to bypass authentication and view/change PII data.

Responded to an urgent incident where a firm's accounts receivable process was hijacked by an attacker causing ~$100k in fraudulent wire transfers.