As a provider of critical infrastructure across electricity, heating, water, and wastewater services, Energi Ikast wanted an independent assessment of its cybersecurity posture from a third party. To achieve this, the company carried out an Assume Breach assessment together with a Southern Jutland district heating utility. The assessment covered both organisations, as they shared an Active Directory environment. “Two of our business partners recommended Bureau Veritas Cybersecurity Nordics. The recommendation proved well-founded, and collaboration was flawless throughout the entire engagement,” says Ole Cholewa, IT Manager at Energi Ikast.
The primary objective of the assessment was to identify blind spots within the environment that could potentially be exploited by an attacker. “Even when you feel you’re doing things properly, there are always areas that fall a little short. The assessment helped make those visible. We were very satisfied with the results,” says Ole.
What we did
- Conducted an Assume Breach assessment starting from a standard user account
- Mapped opportunities for privilege escalation and unauthorised access across environments
- Identified security weaknesses, including overprivileged accounts and passwords stored in clear text
- Delivered documentation and recommendations to support prioritised remediation
Impact
- Gained an independent and realistic view of the organisation’s security posture
- Identified security challenges that had previously gone unnoticed
- Confirmed the need for continued focus on access rights and identity and access management
- Remediated a number of identified issues following the assessment