DORA-Art27-P1

THREAT-LED PENETRATION TESTING (TLPT) EXECUTION REPORT
Nordvik Bank AG
TLPT ID: TLPT-2025-001
Execution Date: 1 April – 10 June 2025
Prepared by: RedForce Security BV
Reviewed by: Katrin Halvorsen, CISO, Nordvik Bank AG
Classification: Strictly Confidential

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

EXECUTIVE SUMMARY

RedForce Security BV conducted a threat-led penetration test (TLPT) of Nordvik
Bank AG between 1 April and 10 June 2025, targeting five critical business
functions across the Bank's production ICT environment. The TLPT was conducted
in accordance with DORA Article 26 and followed the TIBER-EU framework.

Key Results:
  — Attack scenarios executed: 6
  — Total findings: 14
  — Critical findings: 2
  — High findings: 4
  — Medium findings: 5
  — Low findings: 3
  — Defence team detection rate: 67% (4 of 6 scenarios detected)
  — Mean time to detect (for detected scenarios): 18.5 hours
  — Mean time to contain (for detected scenarios): 6.2 hours

The TLPT revealed that while the Bank's perimeter defences and endpoint protection
are effective against commodity threats, sophisticated multi-stage attacks exploiting
trust relationships between internal systems can bypass detection for extended
periods. Two critical findings relate to the ability to move laterally from a
compromised treasury workstation to the payment processing infrastructure, and
the ability to extract authentication tokens from a misconfigured API gateway cache.

The Bank's SOC detected 4 of 6 attack scenarios, demonstrating adequate but
improvable detection capabilities. The two undetected scenarios exploited
legitimate administrative tools and encrypted channels that blended with normal
traffic patterns.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

THREAT INTELLIGENCE SUMMARY

ThreatScape Europe AG delivered the targeted threat intelligence report on
15 March 2025. The report identified the following primary threat actors and
attack vectors relevant to Nordvik Bank AG:

  Threat Actor Profile 1: State-Sponsored Financial Espionage
    Motivation: Intelligence gathering on financial flows and sanctions compliance
    Capability: Advanced persistent threat (APT) with custom tooling
    Relevance: Medium — Bank processes cross-border payments subject to sanctions

  Threat Actor Profile 2: Organised Cybercrime (Ransomware)
    Motivation: Financial gain through ransomware and data extortion
    Capability: Sophisticated initial access via phishing and supply chain
    Relevance: High — primary threat to mid-size European banks

  Threat Actor Profile 3: Insider Threat (Privileged User)
    Motivation: Financial gain or coercion
    Capability: Legitimate access to critical systems
    Relevance: Medium — Bank has 47 privileged users across IT and operations

The red team developed attack scenarios based on these threat profiles, simulating
realistic attack chains that a motivated adversary would employ against the Bank.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

RED TEAM ACTIVITIES

  Scenario    Threat Profile    Target Function              Detected?
  ─────────────────────────────────────────────────────────────────────────────
  SC-01       Ransomware        Customer Account Mgmt         Yes (12h)
  SC-02       APT               Treasury Operations           No
  SC-03       Ransomware        Retail Payment Processing     Yes (8h)
  SC-04       Insider           Regulatory Reporting          Yes (32h)
  SC-05       APT               Customer Authentication       No
  SC-06       Ransomware        Customer Account Mgmt         Yes (22h)

  Detection Rate: 67% (4/6)
  Average Detection Time (detected): 18.5 hours

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

ATTACK SCENARIOS EXECUTED

Scenario SC-01: Ransomware — Customer Account Management
  Initial Access:    Spear-phishing email with malicious macro document
  Execution:         Macro executed PowerShell downloader; CrowdStrike EDR
                     detected the payload but a modified variant evaded detection
  Lateral Movement:  Moved from compromised workstation to file server using
                     stolen credentials from memory
  Objective:         Encrypt customer account database
  Result:            Detected by SOC after 12 hours via anomalous file access
                     patterns. Contained within 4 hours of detection.
  Impact Assessment: Moderate — attacker gained access to file server but was
                     contained before reaching database tier.

Scenario SC-02: APT — Treasury Operations
  Initial Access:    Compromised third-party market data feed update mechanism
  Execution:         Injected backdoor into legitimate software update package
  Lateral Movement:  Used legitimate administrative tools (PsExec, WMI) to
                     move from market data server to treasury workstation
  Objective:         Access payment initiation capability
  Result:            NOT DETECTED — red team maintained persistent access for
                     3 weeks. Lateral movement via legitimate tools blended
                     with normal administrative traffic.
  Impact Assessment: Critical — demonstrates that supply chain compromise
                     combined with living-off-the-land techniques can bypass
                     current detection capabilities.

Scenario SC-03: Ransomware — Retail Payment Processing
  Initial Access:    Exploitation of vulnerable web application (staging instance
                     accessible from internet)
  Execution:         Web shell deployed on staging server; pivoted to production
                     network via shared service account
  Lateral Movement:  Service account had access to payment gateway configuration
  Objective:         Disrupt payment processing
  Result:            Detected by SOC after 8 hours via IDS alert on unusual
                     traffic from staging to production zone. Contained within
                     2 hours.
  Impact Assessment: High — staging-to-production pivot path should not exist.

[Scenarios SC-04 through SC-06 detailed in Appendix A]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

FINDINGS AND IMPACT

  ID         Severity    Title
  ─────────────────────────────────────────────────────────────────────────────
  TLPT-F01   Critical    Lateral movement from treasury to payment systems
                         via trust relationship exploitation
  TLPT-F02   Critical    Authentication token extraction from API gateway
                         cache enabling session hijacking
  TLPT-F03   High        Supply chain attack vector via market data feed
                         update mechanism
  TLPT-F04   High        Staging-to-production network path via shared
                         service account
  TLPT-F05   High        Living-off-the-land techniques evade SIEM detection
                         rules (PsExec, WMI, PowerShell remoting)
  TLPT-F06   High        Insufficient monitoring of encrypted east-west
                         traffic in production zone
  TLPT-F07   Medium      Weak service account password policy (no rotation)
  TLPT-F08   Medium      Excessive file share permissions for IT staff
  TLPT-F09   Medium      Missing network segmentation between staging and
                         production environments
  TLPT-F10   Medium      Incomplete logging of administrative tool usage
  TLPT-F11   Medium      SOC playbooks lack procedures for supply chain
                         compromise scenarios
  TLPT-F12   Low         Outdated threat intelligence feeds in SIEM
  TLPT-F13   Low         Inconsistent endpoint hardening across server fleet
  TLPT-F14   Low         Missing alerting for dormant privileged accounts

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

DEFENCE TEAM RESPONSE ASSESSMENT

The Bank's Security Operations Centre (SOC) demonstrated competent detection and
response capabilities for known attack patterns. Key observations:

  Strengths:
    — Rapid containment once threats were detected (average 6.2 hours)
    — Effective use of EDR for endpoint-level threat detection
    — Good coordination between SOC and incident response team
    — Appropriate escalation to CISO for critical detections

  Areas for Improvement:
    — Detection of living-off-the-land techniques requires enhanced behavioural
      analytics and UEBA capabilities
    — Supply chain compromise scenarios not covered in current SOC playbooks
    — East-west encrypted traffic monitoring gap limits visibility
    — Administrative tool usage monitoring insufficient for detecting
      lateral movement via legitimate tools

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

REMEDIATION REQUIREMENTS

  Priority     Finding     Recommended Action                  Deadline
  ─────────────────────────────────────────────────────────────────────────────
  Immediate    TLPT-F01    Segment treasury and payment         31 Jul 2025
                           systems; remove trust relationships
  Immediate    TLPT-F02    Secure API gateway cache; implement  31 Jul 2025
                           token binding and short-lived tokens
  High         TLPT-F03    Implement software supply chain      30 Sep 2025
                           integrity verification
  High         TLPT-F04    Isolate staging from production;     31 Aug 2025
                           eliminate shared service accounts
  High         TLPT-F05    Deploy UEBA and enhance SIEM rules   31 Oct 2025
                           for administrative tool monitoring
  High         TLPT-F06    Implement east-west TLS inspection    30 Sep 2025
  Medium       TLPT-F07    Implement service account password    30 Nov 2025
               to F11      rotation; address remaining findings
  Low          TLPT-F12    Update threat intelligence feeds;     31 Dec 2025
               to F14      address remaining low findings

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

COMPETENT AUTHORITY SUMMARY

A summary of this TLPT execution report will be submitted to FINMA in accordance
with DORA Article 26(6). The summary will include: scope of testing, threat
intelligence basis, key findings (anonymised where appropriate), defence team
performance metrics, and the remediation plan timeline.

Submission Reference: FINMA-TLPT-2025-NVK-001-REPORT
Planned Submission Date: August 2025

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Prepared by: RedForce Security BV
Lead Red Team Operator: [Red Team Lead]
Reviewed by: Katrin Halvorsen, CISO, Nordvik Bank AG
Date:        15 June 2025

{
  "factId": "c1d2e3f4-a5b6-7890-abcd-300000000008",
  "evidenceId": "d0e1f2a3-b4c5-6789-abcd-300000000008",
  "evidenceClassId": "tester-independence-attestation",
  "factType": "tester_independence_status",
  "data": {
    "attestation_date": "2025-01-20",
    "tester_type": "external",
    "tester_organisation": "CyberShield GmbH",
    "independence_confirmed": true,
    "conflicts_of_interest_none": true,
    "qualifications_verified": true,
    "sufficient_resources_allocated": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-25T09:00:00Z",
  "supersededBy": null
}

{
  "factId": "c1d2e3f4-a5b6-7890-abcd-300000000006",
  "evidenceId": "d0e1f2a3-b4c5-6789-abcd-300000000006",
  "evidenceClassId": "tlpt-execution-report",
  "factType": "tlpt_execution_status",
  "data": {
    "tlpt_date": "2025-06-10",
    "tlpt_performed": true,
    "covers_critical_functions": true,
    "threat_intelligence_used": true,
    "findings_count": 14,
    "critical_findings": 2,
    "defence_detection_rate_percent": 67.0,
    "competent_authority_notified": true,
    "next_tlpt_due_date": "2028-06-10"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-06-20T09:00:00Z",
  "supersededBy": null
}

TESTER INDEPENDENCE ATTESTATION
Nordvik Bank AG
Engagement Reference: PT-2025-001 (Annual Penetration Test)
Attestation Date: 20 January 2025
Classification: Internal — Restricted

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

INDEPENDENCE DECLARATION

This attestation is issued in accordance with DORA Article 27, which requires
that testers carrying out digital operational resilience testing meet appropriate
requirements for independence, expertise, and resource allocation.

I, the undersigned, hereby confirm the following with respect to the penetration
testing engagement PT-2025-001 conducted for Nordvik Bank AG:

1. INDEPENDENCE

   CyberShield GmbH ("the Testing Firm") is an independent third-party security
   testing provider with no organisational, financial, or contractual relationship
   with Nordvik Bank AG beyond the scope of this testing engagement and prior
   testing engagements.

   The Testing Firm:
     — Is not a subsidiary, affiliate, or joint venture partner of Nordvik Bank AG
     — Does not provide IT consulting, system integration, or managed security
       services to Nordvik Bank AG
     — Has not been involved in the design, development, or implementation of
       any ICT systems or security controls at Nordvik Bank AG
     — Does not hold any financial interest in Nordvik Bank AG or its parent
       company

   The testing team members assigned to this engagement:
     — Have no personal relationships with Nordvik Bank AG employees involved
       in the systems under test
     — Have not been employed by Nordvik Bank AG within the past 24 months
     — Are not simultaneously engaged in any advisory or consulting capacity
       with Nordvik Bank AG

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. CONFLICT OF INTEREST ASSESSMENT

   A formal conflict of interest assessment was conducted prior to the engagement.
   The assessment covered:

     — Organisational conflicts: None identified. CyberShield GmbH has no
       business relationship with Nordvik Bank AG beyond security testing.
     — Personal conflicts: None identified. All team members completed
       individual conflict of interest declarations.
     — Financial conflicts: None identified. CyberShield GmbH holds no
       investments in Nordvik Bank AG or related entities.
     — Prior engagement conflicts: CyberShield GmbH conducted the 2024
       penetration test for Nordvik Bank AG. This is the second consecutive
       engagement. In accordance with best practice, the Bank will rotate
       to a different testing provider for the 2026 engagement to maintain
       fresh perspective.

   Conclusion: No conflicts of interest exist that would compromise the
   objectivity or independence of this testing engagement.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. TESTER QUALIFICATIONS

   The testing team assigned to engagement PT-2025-001 holds the following
   qualifications:

     Team Lead:
       — OSCP (Offensive Security Certified Professional)
       — CREST Certified Tester (CCT) — Infrastructure
       — 12 years of penetration testing experience
       — Specialisation: financial services and critical infrastructure

     Senior Tester 1:
       — OSCP, OSCE (Offensive Security Certified Expert)
       — CREST Certified Tester (CCT) — Application
       — 8 years of penetration testing experience
       — Specialisation: web application and API security

     Senior Tester 2:
       — OSCP, GPEN (GIAC Penetration Tester)
       — 6 years of penetration testing experience
       — Specialisation: network infrastructure and cloud security

   All team members maintain current certifications and participate in
   continuous professional development. Certification records are available
   upon request.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. RESOURCE ALLOCATION CONFIRMATION

   CyberShield GmbH confirms that adequate resources have been allocated to
   this engagement:

     — Testing team: 3 qualified testers (as detailed above)
     — Testing duration: 10 business days (3–14 February 2025)
     — Total effort: 30 person-days
     — Testing infrastructure: Dedicated testing environment with isolated
       network access, secure VPN connectivity, and encrypted data handling
     — Reporting: 2 additional person-days for report preparation and review
     — Retesting: 3 person-days allocated for remediation verification
       (scheduled 28 March 2025)

   The allocated resources are proportionate to the scope of the engagement
   and sufficient to conduct a thorough assessment of the systems under test.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

ATTESTATION

I hereby attest that the information provided in this document is true and
accurate to the best of my knowledge. CyberShield GmbH will immediately notify
Nordvik Bank AG's CISO if any circumstance arises during the engagement that
could compromise the independence or objectivity of the testing.

Attested by:  [Managing Director, CyberShield GmbH]
Organisation: CyberShield GmbH
Date:         20 January 2025

Acknowledged by: [Head of Internal Audit, Nordvik Bank AG]
Date:            22 January 2025

Acknowledged by: [Katrin Halvorsen, CISO, Nordvik Bank AG]
Date:            22 January 2025

{
  "factId": "c1d2e3f4-a5b6-7890-abcd-300000000008",
  "evidenceId": "d0e1f2a3-b4c5-6789-abcd-300000000008",
  "evidenceClassId": "tester-independence-attestation",
  "factType": "tester_independence_status",
  "data": {
    "attestation_date": "2025-01-20",
    "tester_type": "external",
    "tester_organisation": "CyberShield GmbH",
    "independence_confirmed": true,
    "conflicts_of_interest_none": true,
    "qualifications_verified": true,
    "sufficient_resources_allocated": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-25T09:00:00Z",
  "supersededBy": null
}

{
  "factId": "c1d2e3f4-a5b6-7890-abcd-300000000006",
  "evidenceId": "d0e1f2a3-b4c5-6789-abcd-300000000006",
  "evidenceClassId": "tlpt-execution-report",
  "factType": "tlpt_execution_status",
  "data": {
    "tlpt_date": "2025-06-10",
    "tlpt_performed": true,
    "covers_critical_functions": true,
    "threat_intelligence_used": true,
    "findings_count": 14,
    "critical_findings": 2,
    "defence_detection_rate_percent": 67.0,
    "competent_authority_notified": true,
    "next_tlpt_due_date": "2028-06-10"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-06-20T09:00:00Z",
  "supersededBy": null
}