All-Around IT Security Assessment for a US Insurtech Company

Summary

A US insurtech company running an insurance marketplace handles sensitive customer data and treats cybersecurity as a top priority. It asked INNERLUXES for an all-around security assessment covering web application and API penetration testing, social engineering, and an AWS infrastructure audit. INNERLUXES found and ranked the issues across all three areas and delivered actionable reports that the client's IT team used to remediate the flaws quickly and raise its overall security posture.

About the Customer

The Customer is a US InsurTech company that maintains an A+ rating with the Better Business Bureau. It runs a convenient insurance marketplace that helps thousands of users find optimal insurance plans at an affordable price.

Why a Comprehensive Assessment Was Needed

Because the company handles its clients' sensitive data, a security breach would damage its reputation and financial stability, so it wanted a comprehensive assessment spanning web application and API penetration testing, an AWS infrastructure security audit, and social engineering testing — and a partner well-versed in cloud and web security. INNERLUXES was contracted for the project.

Penetration Testing of the Web App and APIs

Using credentials supplied by the Customer, INNERLUXES performed gray-box penetration testing of one web application and two APIs, following the OWASP Web Security Testing Guide and the NIST 800-115 methodology with a mix of automated and manual checks and likely attack scenarios. The targets had no critical, easily exploitable flaws, but the APIs showed medium-severity issues:

• Improper input validation that could let an attacker gain unauthorized access, steal sensitive information, or disrupt the app — addressed by recommending semantic and syntactic input validation.
• An outdated Nginx web server that needed upgrading before its vulnerabilities could be used to execute arbitrary code or crash the server.

The team also reported minor flaws such as missing HTTP security headers, insecure TLS 1.0/1.1 protocols, lacking brute-force protection, and sensitive-information disclosure via an HTTP response header, with remediation measures for each.

Social Engineering: Phishing and Vishing

The Customer provided 38 employee email addresses. INNERLUXES ran phishing testing in three stages: it confirmed the email servers block suspicious links, forms, and attachments from non-whitelisted senders; it then exploited the input-validation flaw to send a phishing link from one of the Customer's own addresses, which 4 of the 38 employees clicked; and finally, with test addresses whitelisted, the phishing emails landed in junk and employees treated them as suspicious. In a vishing campaign, a tester posing as tech support asked employees to allow a remote connection or run a command and share the output — one employee complied, while the others refused and reported the calls to their manager. INNERLUXES rated the company's resilience to human-based attacks as high and recommended consistent security-awareness training and continuous email-security upgrades.

AWS Cloud Security Audit

An INNERLUXES AWS security specialist manually reviewed the Customer's AWS components — Lambdas, an Elastic Beanstalk app, VPC, S3, EC2, and more — and found several misconfigurations that could allow unauthorized access to corporate data. The recommendations followed AWS best practices:

• Review the multiple admin accounts and limit permissions to those each user role actually needs.
• Set up multi-factor authentication for all users.
• Enable AWS Config for full visibility of resource configuration and automated alerts on undesired changes.
• Enable and configure CloudTrail to continuously monitor activity across the infrastructure.
• Configure the AWS Web Application Firewall (WAF) to defend against cross-site scripting, CSRF, SQL injection, and more.

Actionable Reports and a Stronger Security Posture

• The Customer received comprehensive reports on the penetration testing, social engineering testing, and AWS infrastructure audit, with vulnerabilities classified by severity and the required corrective measures.
• Following the guidance, the IT team quickly fixed the flaws and achieved a high security level across the IT environment.
• The reports also serve as proof of due diligence that may be needed for compliance attestation.

Technologies and Tools

Burp Suite, Metasploit, Postman, OWASP ZAP, KiteRunner, Vooki, Nmap, SSLScan.