CPIT InfoSec case studies

CPIT InfoSec · Put your knowledge to work in context.

CPIT Information Security is a professional certification for IT practitioners who already work with systems, networks, or applications and now need to demonstrate that they can protect them. It suits system and network administrators moving toward a security role, security analysts broadening beyond a single toolset, and auditors or consultants who need a common vocabulary across governance, architecture, operations, and privacy. The CPIT InfoSec case studies are 5 cases and about 3,977 words.

Two Security Policies, One Company: Who Accepts the Risk?

Harborline Financial completes its acquisition of Vellbrook, a 900-person payments processor, in six weeks. Both firms hold ISO/IEC 27001 certification but under different scopes.

770 words, about 4 min 2

Script Integrity Monitoring or Re-platforming: A Quantitative Risk Call

Cedar & Fold is a 320-store apparel retailer with EUR 1.1bn revenue. Its risk team has quantified the dominant scenario for the web checkout: a client-side script compromise of the payment page.

770 words, about 4 min 3

Segmenting a Flat Network That Stops Production When Touched

Nordhaven Precision manufactures components at three plants and runs a single flat /16 for everything: 380 engineering workstations, an ERP cluster, a 700-seat call centre, and 12 CNC cell controllers that run Windows XP and 7, are vendor-locked and cannot be patched. Last month a phished workstation spread ransomware over SMB to 40 servers in three hours, using one shared local administrator password unchanged since 2016.

801 words, about 4 min 4

Push Fatigue, a Persuadable Service Desk and a Clinical Veto

Meridian Health Partners runs 4 hospitals and 90 clinics with 6,800 staff and 1,200 affiliated physicians. All workforce accounts are behind single sign-on; multifactor is enforced for 100 percent of accounts, but 38 percent still use SMS or voice callbacks and 62 percent use push notification.

821 words, about 4 min 5

Ransomware at 02:14: Wipe, Notify, or Pay?

Trasker Freight moves 1.4 million consignments a year with 2,600 staff in the Netherlands, Germany, Poland and the UK. On a Tuesday at 02:14 the EDR console raised mass file-encryption alerts; by 06:00, 340 of 410 servers and 1,900 endpoints were encrypted.

815 words, about 4 min