Case study · Banking
Tier-1 bank scanning upgraded and extended to web applications
I led the Tenable Security Center upgrade and web application scanning rollout for a Tier-1 Sri Lankan commercial bank, so the application layer is scanned as well as infrastructure.
A Tier-1 Sri Lankan commercial bank
- Tenable Security Center
- Vulnerabilities & exposure
The setup
The architecture, simplified.
- A Tier-1 Sri Lankan commercial bank running vulnerability management on Tenable Security Center.
- Scope: platform upgrade, web application scanner deployment and scan coverage design.
- Delivered by Innov8’s Application Security BU, which I head and led for this work.
The challenge
What made this hard.
- Upgrading without losing coverageThe platform had to be upgraded while existing scans, schedules and reports kept working for the bank’s teams.
- Credentials that make scans countCredentialed scans see far more than unauthenticated ones, so scan credentials took real effort.
- Scan windows in a live bankScans had to fit agreed windows around production systems the bank cannot afford to disrupt.
- Logins that defeat scannersWeb application scans need login sequences that survive session timeouts and multi-factor authentication.
The approach
How the work ran, step by step.
- 01
Coverage review
Mapped what was scanned, how often and with which credentials, against the assets the bank needed covered.
- Asset scope versus scan targets
- Credentialed versus unauthenticated coverage
- 02
Platform upgrade
Upgraded Tenable Security Center while keeping existing scan policies, schedules and reporting working.
- Scan policies and schedules carried over
- Reports checked after the upgrade
- 03
Scan coverage design
Designed coverage around scan credentials and agreed windows, so scans run without disrupting production.
- Scan credentials per platform
- Scan windows agreed with system owners
- 04
Web application scanning
Deployed web application scanning with authentication handled, bringing the application layer into the programme.
- Authenticated scan configuration
- Login sequences that survive timeouts
The outcome
What changed.
Real numbers only where they exist. Everything else is stated plainly, without invented percentages.
- Platform upgradedTenable Security Center upgraded for the bank’s vulnerability management programme.
- Application layer in scopeWeb application scanning deployed, so web applications are scanned alongside infrastructure.
- Coverage by designScan coverage designed around credentials and agreed scan windows, not left to defaults.
Lessons
What I would tell the next team.
- Lesson 01
The hard part is not the scanner
Much of the effort went into scan credentials, scan windows and web application authentication. That is where coverage is won or lost.
- Lesson 02
Authenticated web scans need care
Login sequences must survive session timeouts and multi-factor authentication, or the scanner tests a login page and little else.
- Lesson 03
Scanning is an input, not a programme
A severity-sorted list does not tell teams what to fix first. Add exploit evidence, exposure and business criticality, then validate.
Related
Where this experience shows up in my work.
Why does credentialed vulnerability scanning matter?
A credentialed scan logs in to each system and reads installed software, patch levels and configuration. An unauthenticated scan only sees what is exposed on the network, so it misses much of the real picture. On this Tier-1 bank programme, much of the effort went into scan credentials for exactly that reason. Coverage reports without them can look complete when they are not.
What does web application scanning add to infrastructure scanning?
Infrastructure scanners look for missing patches and weak configuration on hosts. Web application scanning tests the running application for flaws such as injection, broken authentication and insecure session handling, which host scans do not cover. It is a form of dynamic application security testing (DAST). For a bank, internet-facing web applications are often among the most exposed assets, so leaving them out leaves a large gap unmeasured.
Is CVSS enough to decide what to fix first?
No. The Common Vulnerability Scoring System (CVSS) measures technical severity, not risk in your environment. I add evidence of exploitation, such as the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalogue and Exploit Prediction Scoring System (EPSS) scores, plus internet exposure, business criticality and existing controls. That is the core of continuous threat exposure management (CTEM).
More case studies
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- 120applications protectedAround 120 applications under WAAP, API and bot protectionManufacturing · A global apparel group headquartered in Sri LankaImpervaRead the case
- RASPin-app protection liveIn-app runtime protection live in a customer banking appBanking · A leading private bank’s mobile appZimperiumRead the case
- SIEMtelemetry pipelineWAAP security events arriving in the bank’s SIEM, reliablyBanking · A leading Sri Lankan private bankF5 → Logstash → Trellix SIEMRead the case