ENFR — Passer en français
IT emergencyLet’s talk about your project
Cybersecurity team responding to an attack and hardening servers
CASE STUDY / 08ANONYMISED ASSIGNMENT
Operational security · cross-client

Hardening and incident response

Several real compromises handled end to end on production servers, then turned into a reusable method.

← All case studiesA similar challenge?
DURATION3 years
ROLEInvestigation, remediation, hardening
SCOPEOwn and client servers
STATUSMethod in place
THE CONTEXT WE FOUND

Understand the system
before transforming it.

Cleaning up without looking for the entry point means starting again: a showcase site restored without investigation was exploited again 36 hours later. The playbook now requires collecting evidence before remediating.

WHAT WAS DONE

From diagnosis.
To production.

The scope describes the decisions and the work actually carried out, without naming the organisation involved.

01

Identify the vector, not only the process

The signature of an exploitation found in the logs before fixing a critical server-side rendering vulnerability.

02

Treat a repeat as evidence

A manual fix overwritten by a deployment led to versioning and systematically checking every remediation.

03

Write the playbook under real pressure

Order of operations, evidence collection, proven commands and access pitfalls documented for the next incidents.

04

Reduce the exposed surface

Public ports brought from six down to three, services placed behind the reverse proxy and rules adapted to containers.

05

Harden the edge and the access

Per-address rate limiting, geographic filtering, selective bot blocking, VPN and separate key-based accounts.

MEASURED RESULTS

Facts.
Not a logo.

2 vectorsidentified with evidence
6 → 3public ports after hardening
36 hthe delay that exposed the wrong method
Playbookreused and enriched
TECHNOLOGIES IN PRODUCTION

The foundation actually used.

LinuxDockernftables / UFWfail2banTraefikKubernetesWireGuardLog analysis

Clients, brands, domains, addresses and identifying details are not published. The figures come from the logs, databases, clusters, repositories and control reports provided for these assignments. Security incidents are described without any reproducible exploitation path.

OTHER CASE STUDIES

Two other systems.
Two other sets of constraints.

Digital ecosystem connecting a vehicle catalogue, branches and data flows01
Automotive retail · franchise network

National automotive marketplace

A network of around 90 branches, a marketplace in 7 languages and 14 country versions, and the whole system connecting catalogue, acquisition, CRM, distribution, invoicing and cloud operations.

2 yearsIn production
Read the full case study
Modernised public portal with visual checks, security and a delivery chain02
Public sector · national portal

Public service portal

A national portal where users follow sensitive administrative procedures, made of several generations of front end, a business API, a CMS, an SSO and a Kubernetes cluster.

5 yearsMigration under way
Read the full case study

A critical system to build or to take over?

Describe the context, the existing systems and the expected result. We will propose the right level of intervention.

Talk to RGAIX