A regional bank's external and internal penetration tests, and a remediation plan written to FFIEC guidance

A regional bank with about 25 branches needed independent evidence that its defenses held up. Its board and its examiners expected tested proof, not only policies, and its last penetration test was two years old. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. No customer records were needed or viewed.

Everything began with written rules of engagement. The document named the addresses and accounts in scope, the hours the testers could work, the people to call if something broke and the conditions that would pause the test. Banks run systems that cannot stop, so the bank's security officer agreed to every step first. Our team keeps that authorization on file for the same reason an auditor will ask to see it.

The external test looked at what an attacker on the internet could reach: online-banking front ends, remote access, mail, VPN gateways and hosts that had been forgotten after a migration. The internal test started where a thief with a stolen laptop or a malicious visitor would start, on a branch network and then with a standard user account. It checked whether a branch could reach the core banking servers, whether passwords and local administrator rights were reused, and which Active Directory weaknesses led to domain administrator.

Findings were ranked by likelihood and impact and written twice: a short summary for the board and a technical section for the engineers, each item with evidence, a fix and a retest step. The remediation plan followed the structure that FFIEC guidance on information security and risk management describes in general terms: risk assessment, controls, testing, reporting to the board and management follow-up. It gave each item an owner, a priority and a due date. Items the bank chose not to fix at once went on a risk register with management's decision recorded.

Retesting confirmed that the fixed items were closed, and the report was dated and filed. The bank now repeats the cycle each year and after major changes, such as a branch acquisition or a new online-banking release. This is a technical assessment, not a legal opinion, and it does not certify compliance with any regulation; the bank's own examiners and counsel decide that.