State of Cyber-Security in Indonesia

CONTENTS
UNDERSTANDING
INTRODUCTION CYBER-SECURITY ISSUES
Welcome address 4 Top attacks by type 6

2019 Executive Summary 5 Analysis of top Malware by type 8
Analysis of top exploit by type 11
Top attacks by country of origin 16
Analysis of key vulnerability in 2019 18
ABOUT PROTERGO
About Protergo 21
Blue team offering 22
Red team offering 27
2 | P R O T E R G O C Y B E RS E C U R I T Y
ABOUT PROTERGO
We are one of the leading Indonesian cyber-securitY company, Our clients say
that we are quite unique for multiple reasons:
Deep understanding of cyber-security in Indonesia -the 1st in Indonesia to

publish a national cyber-security threat report
International-know-how with Indonesian-roots - our security operation center

in Bintaro comply with BI/ OJK regulations; we are the only Platinum Partner of
AlienVault (used by US Na, CIA)
Innovation as our core value -1st in Indonesia to offer next-gen. anti-virus and
email protection that re-pay if your company is hacked
Above all we are a team of passionate professional -the 1st in Indonesia to use
only certified analysts and penetration testers (CompTIA CySA+, Security+,
Linux+, PCI-DSS, OSCP, ...)
Contact us at info@protergo.id
P R O T E R G O C Y B E RS E C U R I T Y | 3
INTRODUCTION
1. Welcome address
Welcome to the 1st edition of the Protergo In only 2 years we have built some world-class
Indonesia Cyber-Security Report, an annual capabilities in:
publication that we created for our customers,
partners and the industry. Blue team
building one of the first cyber-security
The purpose of this publication is to share our operation center in Indonesia
knowledge on the current state of cyber-security
threats in Indonesia, recommend best-practices Red team
and solutions. What makes this report unique is penetration testing services using leading
the depth of the information contained and the methodologies in the world
specific focus on the Indonesian market.
We continue nowadays to develop our platform,
The source of the report is the data collected using machine learning, automation and
from the Protergo’s network of sensors, alarms, advanced real-time tools to continuously support
signals, on-premise and on-cloud systems and our clients.
services. Every day, Protergo scans over 50+
sensors at different critical points of the We hope the readers found the information in this
Indonesian infrastructure - assets like report helpful, insightful and we sincerely hope
datacenters, telecommunication systems, ISP, that the report can help organizations to protect
banks, insurances, fintech and other large their systems, software and users.
enterprises.
A final word about us at Protergo. We started 2

years ago, with one simple objective in mind: be
the best in what we do that is the most trusted
cyber-security company in Indonesia. Protergo Cyber-Security Team
// 2020 State of the Cybersecurity in Indonesia
2. 2019 Executive Summary
Digitalization has not been all the time followed-up by adequate cyber-security measures. Many
companies in Indonesia have been left behind in the cyber-security space.
Our top 10 summarizes the learnings from this year into 6 must-know
facts and 3 simple recommendations for CEO/ CTO and IT teams.
Top 6 must-know insights
1. Software 4. Viruses
80% of the threats are software 80% of threats are trojan, worms or
related ransonmware
2. Countries 5. Web exploits

US and Russia are top attackers >50% of vulnerabilities are web-related
3. Vulnerabilities 6. Legacy
100+ vulnerabilities for each ~30% of all vulnerabilities are >10 years
organization old
Our 3 simple recommendations
1. Set-up a security operation center to monitor, detect and block key attacks
2. Run annual penetration testing and quarterly vulnerability scanning
3. Prepare for 2020, supporting work from home through endpoint security, anti data loss
prevention, email and cloud security
Protergo Cyber-Security Team
UNDERSTANDING
CYBER-SECURITY ISSUES
3. Analysis of top attacks by type

80% of the threats are software-related, specifically from malware
and exploit campaigns to Indonesian companies
In 2019, 5 main types of attacks to Indonesian

companies
Malware
malicious software designed to harm
computer systems
Exploit
active attacks by hackers to
corporate systems
Policy & access violations

employee using non-authorized
Our data shows that
software (e.g., peer to peer) 80% of the attacks are
concentrated in 2 key
Vulnerability
categories, Malware
unpatched software that can be
easily exploited and Exploits attacks as
reported in Chart #1.
Network attacks
network attacks that includes denial
of services and flooding
Chart 1:
Top attacks by type
3% Network Attack
5% Vulnerability
43% Malware
8% Other
9%
Policy &
Access Violation
32% Exploit
Malware Exploit
Malware is a collection of malicious software Exploitation is the next stage in an attacker's list
variants, including ransomware, viruses, and after he spots the vulnerability. Exploits are the
spyware. It usually consists of code created by ways through which a vulnerability is leveraged
cyber attackers, developed to result in extensive for nasty activity by hackers; these may include
damage to systems and data or to gain unlawful pieces of the software, arrangements of
access to the network. Malware is usually commands, or even the open-source exploit kits.
delivered in the form of a file or link via email.
State of the Cybersecurity in Indonesia // 2020
Vulnerability Policy & Access Violations

Mistakes do occur, even in the process of It is the unauthorized access to the files or data.
developing and coding technology. What’s left Policy violation happens when somebody gets
behind from those is commonly called a bug. access to more data that he/she is supposed to
While bugs aren’t integrally harmful, many can be have. Usually, the violations happen internally
taken benefit of by evil actors—these are called and these are the company's internal issues.
vulnerabilities. Vulnerabilities can be used to Common violations include use of peer to peer
force the software to act in a way it’s not networks or file sharing software.
designed for, like gaining information regarding
the current security measures in place.
Network attacks
Those are network related attacks that typically include denial of services attacks or network flooding.
Those categories of attacks target specifically the network devices.
3.a Analysis of top Malware by type
Our data shows that 80% of the attacks from Malware are
concentrated in 3 key categories as Trojan, Worms and
Ransomware, those categories are different in the following way:
Trojan
software designed to infiltrate itself and give
hackers the ability to control a software system
remotely.
Worm
software designed to spread across as many devices
and computers as it can in order to increase the
hackers exposure to a given institution.
Ransomware
software designed to block a critical system and
to request for money in order to unlock it.
1% Adware 1% Virus
2% Rootkit 1% Bot
1% Spyware
13%
Ransomware
32% 49%
Worm Trojan
Chart 2: Top malware by type
Spyware Virus
Spyware is an executable software that is being A computer virus is an agent in a computer
installed on one’s system and would start system, first being found and introduced in 1983.
monitoring one’s behavior without them noticing This agent is usually being transmitted cross
or directly permitting. Spyware contains the term devices and usually being transferred through
‘Spy’, which literally means to observe or to storage media. After entering a system, a virus
directly monitor one’s activity. would attach itself to another program. When the
host program is being executed, the virus is being
run alongside the host program.
Bot Rootkit
Bots are used to execute attacks involving A rootkit is a computer program that is
credential thieves, authorizing illegitimate access, designated to grant an integrated privilege to
or distributed denial of service. access the system – all the operations are being
Bot attackers can have access to thousands of carried on stealthily. Rootkit itself is a
computers in one moment of time and combination of two words, they are ‘root’ and
simultaneously command them to execute ‘kit’. Root talks about the literal root access of a
malicious activities. system. Kit is all about the tool and media.
Adware
Adware is a software designated to burst advertisements up on your display – and is commonly found in
applications, or web browsers.
Client Side Exploit - Backdoor — DoublePulsar

Known Vulnerability Description:
Possible MS17-010 DoublePulsar is a backdoor implant tool
developed by the U.S. National Security Agency's
Description: (NSA) Equation Group that was leaked by The
Microsoft released a security update to patch the Shadow Brokers in early 2017. The tool infected
MS17-010 vulnerability. This security update more than 200,000 Microsoft Windows
resolves vulnerabilities in Microsoft Windows. The computers, and was used alongside EternalBlue
most severe of the vulnerabilities could allow in the May 2017 WannaCry ransomware attack.
remote code execution if an attacker sends Impact:
specially crafted messages to a Microsoft Server DoublePulsar runs in kernel mode, which grants
Message Block 1.0 (SMBv1) server. cybercriminals a high level of control over the
Impact: computer system. Once installed, it uses three
Remote Code Execution commands: ping, kill, and exec, the latter of which
can be used to load malware onto the system
Mirai Malware
Description:
Mirai is a malware that turns networked devices running Linux into remotely controlled "bots" that can be
used as part of a botnet in large-scale network attacks.
Impact :
As a self-propagating botnet virus, Mirai can coordinate a DDOS attack. We have detected Mirai since start
of 2019 in Indonesian banks and financial institutions.
Trojan infection — Glupteba Trojan infection — Virut DGA

Description: Description:
Glupteba is a trojan-type program, malicious Virut is a malware botnet that is known to be used
software that is designed to install other software for cybercrime activities such as DDoS attacks,
of this kind. It is known that cyber criminals spam, fraud, data theft, and pay-per-install
distribute Glupteba through malicious activities. It spreads through executable file
advertisements that can be injected into legitimate infection (through infected USB sticks and other
websites or advertising networks media), and more recently, through compromised
Impact: HTML files (thus infecting vulnerable browsers
Trojan.Glupteba is usually dropped by exploit kits. visiting compromised websites)
It can download and install further malware and Impact:
add the affected system to a botnet. It has the Malware creators use DGA's because they are
tendency to pretend to be an updater for legitimate harder to detect compared to hardcoded IPs or
software. Further impact tus trojan can stolen domain names; by not hardcoding the location of
browser history, cookies, logins, passwords, the C&C in the malware binary itself, the attacker
identity theft, exploited router, email spam. can better hide and protect the mothership
3.b Analysis of top Exploit by type
90% of the Exploit are either Server Attacks or SMB vulnerability

exploits.
2% 1%
Web Attack SSL Attack
1%
6% Phishing
SQL Injection
30% 60%
SMB Exploit Server Attack
Chart 3: Top Exploit by Type
Server Attack (DOS & DDOS) SMB Exploit

Server attacks are direct attacks to web servers. Microsoft's Server Message Block protocol
Those include DOS & DDOS attacks that are (SMB)is a protocol allowing the applications on a
carried out to disrupt the server activity and system to modify – read and write files also to
causing downtime. Other type of server attacks request services over the network. This particular
include exploitation to applications, ftp and web vulnerability exists due to an obsolete SMB
servers. version, allowing a null session connection
through an anonymous login. The attacker would
be able to send abnormal packets and falsely
execute various commands on the victim’s
system. This EternalBlue vulnerability is
commonly known as (MS17-010).The EternalBlue
has been directly related to the WannaCry
ransomware.
SQL Injection Phishing

SQL Injection is a method to execute a web Phishing is simply defined as an attempt to
hacking by entering a malicious code in the SQL basically ‘fish’ users to input their sensitive
statement through input tabs in a web page. SQL- information such as credentials (username,
I itself is accounted as one of the most common password, credit card details, etc.) by mimicking a
web-based vulnerabilities. In some cases, SQL legitimate source through an electronic
Injection can lead to false deletion of data, data communication. This Phishing is done by
manipulation, false data insertion, and executing executing an email spoofing, or through website
commands on the server to carry out malicious duplication platform, or even messages.
activities.
SSL Attack Web attack (Cross Site Scripting – XSS)

SSL, or known as Secure Socket Layer or known Cross Site Scripting, more familiarly known as
as TLS (Transport Layer Security) is a protocol ‘XSS’ is a security vulnerability existing in web-
designed to ensure security in a network based applications. XSS attack is carried out by
communication by encryption. This protocol is sending a malicious code (script) through a web
directly associated with other protocols such as application to different users accessing the same
SMTPS, IMAPS, or HTTPS. For an SSL Attack, it web application. These codes are embedded as a
typically occurs during handshake (request) by a a browser side script. The XSS itself can run various
mediator between two parties, no other than the commands involving cookie disclosure, session
user and the legitimate website. SSL attack could takeover, malware installation, or unintended
lead to Heartbleed, Stripping, or information browser redirections.
leakage. This could be dangerous for the user
side, as some of them do not even notice that
they are directly sending their information to the
man in the middle.
3.c Network Attacks
A network attack is made to gain unauthorized access to the

business’s network, in aim to steal data. There are three categories of
network attacks as follows:
DDOS
A distributed denial-of-service (DDoS) attack is an
12%
DDOS
attempt to interrupt the usual traffic of a targeted
server, network or service by overloading the
target or its close infrastructure with excessive 18%
Internet traffic. Flood
Flood
Flood is a Denial of Service (DoS) attack made to
bring a service or network down by drowning it
with a huge volume of traffic. It eventually fills the
host's memory buffer and interrupts the
processes. 70%
Network Anomaly
Network Anomaly
At the core of mastering hacking and stealing data
is the knowledge of anomalous network
behaviors. Anomaly is something that varies from
what is normal, standard or expected.
3.d Vulnerability
5%
System Scanning
34%
Software Unpatched
61%
Cleartext
Chart 5: Top vulnerability by type
Cleartext
Cleartext is a stored or shared text that is not subjected to encryption and is not intended to be encrypted.
System Scanning Software Unpatched

Credentialed and non-Credentialed scans (also Unpatched systems are key vulnerabilities of an
called authenticated and non-authenticated IT system. Software updates, including security
scans respectively) are the two key sub- patches, are usually applied immediately based
categories of vulnerability scanning. non- on the security policy and procedures designed to
credentialed scans, do not necessitate satisfy compliance needs.
credentials and don't get the trusted access to the
systems to be scanned.
3.e Category and policy violations attacks
Policy & violation are

unauthorized access to the
files, data or applications. The
sub-categories are as follows:
Access Violation Non Brute attack

13%
This attack is a trial-and-error way used to get
Access Violation Non Brute attack
information like a user password or personal
identification number (PIN).
17%
Policy Violation Policy Violation
Policy violation is the internal act that bypasses or

breaks security policies, procedures or practices.
23%
Backdoor
Backdoor
Backdoor is the undocumented way of obtaining
access to any program, online service or the
whole computer system. A backdoor bypasses
usual authentication mechanisms. It is developed
by the programmer who makes the code for the
program and is a potential security risk.
47%
Bruteforce
Bruteforce
It is the simplest method to gain access to a
server or site (that is password protected). It tries
numerous combinations of usernames and
passwords repeatedly until it gets in.
4. Top attacks by country of origin
Protego has reviewed all the top attackers in Indonesia by country.

United States and Russia being top recorded attackers to Indonesia.
Distribution of attack sources by country - January to December 2019
49.80% USA 2.43% Germany 0.39% Denmark
10.25% Russia 1.08% Singapore 0.36% Uruguay
5.84% Netherlands 0.91% France 0.24% Mexico
5.55% Indonesia 0.81% Romania 0.12% Thailand
5.37% China 0.59% Sri Lanka 0.08% Poland
5.20% Australia 0.52% India 0.04% Spain
3.62% Samoa 0.50% England 0.03% Sweden
3.23% Italy 0.46% Canada 0.03% South Africa
2.54% Philippine
USA The attacks from the USA are typically focused

on two key types of attacks:
50% Malware
out of the total attacks
(Mylobot, Rootkit, Worm, etc.)
Exploit
(SMB Vulnerabilities, XSS, etc.)
Russia The attacks from Russia top attacks’ are slightly

different with mostly two key categories:
10% Network Attack

of the total attacks
(Nmap, MS inbound on Non Standard Port, etc.)
Exploit
(SQL injections, Phishing spam, etc.)
Netherlands And from Netherlands the most common

patterns are:
6% Network Attack
of the total attacks
(Nmap, MS inbound on Non Standard Port, etc.)
Malware
(Adware infection)
5. Analysis of key vulnerability in 2019
5.1 The average organization had over 100 vulnerabilities;

over 25% of those were exploitable by attackers
(in the critical and high category)
Average number of key vulnerability by type for a typical organization
Info
19 Vulnerabilities
vulnerabilities that will allow attackers to gather
INFO
more information about a system (e.g., banner
information for a web server version).
Low
vulnerabilities that pose limited risk of system
35 compromise; may allow an attacker to gain more
LOW confidential information about a system (e.g., how
many users are connected to a system) but will
not allow an attacker to gain access to the
system.
Medium
25 vulnerabilities that pose some risk of system
MEDIUM compromise; may allow an attacker to gain
confidential information about a system (e.g.,
value of system variables) but will not allow the
attacker to directly exploit the system.
High/ Critical
24
HIGH/ CRITICAL vulnerabilities that allow an attacker to access the
system.
5.2 Within the critical/ high category, over 50% of the

vulnerability were web-related, mostly related to PHP and
Web Server administration
Web application/ PHP PHP 53%

Apache 7%
vulnerabilities related to outdated version of PHP. OpenSSL 3%
Microsoft 2%
Oracle 2%
Web server/ Apache phpMyAdmin 2%
PostgreSQL 2%
outdated version of Apache web servers.
http 2%
JBoss 1%
Open SSL SSL 1%
Adobe 1%
vulnerability in the SSL certificate. phpinfo 1%
MySQL 1%
Check 1%
Microsoft SMB
MS 1%
vulnerability in the SMB protocol. DCE 1%
VNC 1%
PRTG 1%
Oracle Asing `secureac`Coo 1%
Untrusted 1%
vulnerable version of the Oracle platform.
Test 1%
OS 1%
phpMyadmin osTicket 1%
webgrind 1%
issues in the phpMyadmin version that allow Galilery 1%
attackers to gain access. HP 1%
XAMPP 1%
Detect 1%
postgreSQL
VMSA 1%
vulnerability in the database (including no Double 1%
password or default password). Vulnerabilities 1%
MacOS 1%
Webmin 1%
Mail 1%
Mort 1%
Unprotected 1%
5.3 30% of the key vulnerabilities are 3 years old but

surprisingly ~30% of the key vulnerabilities are older than
5 years
Analysis of distribution of key vulnerabilities by year
Older than 2008 2%
2008 0%
2009 1%
2010 1%
2011 4%
2012 7%
2013 6%
2014 6%
2015 14%
2016 23%
2017 9%
2018 14%
2019 8%
What is Protergo doing about
the current situation?
Protergo delivers cyber-security

solutions to over 30+ banks in
Indonesia and 10+ telco players.
Blue team services
a. Security Operation Center
b. Work from Home
c. Remote Desktop
d. Mobile Device Protection
e. Next-generation Antivirus
Red team services
f. Anti Data-Loss Prevention
g. Email Protection a. Vulnerability Assessment
b. Penetration Testing
Protergo is the only

Platinum AlienVault Partner
in Indonesia.
Blue Team Service
PROTERGO BLUE TEAM SERVICES
1. a. Security Operation Center
What is it? Benefits & Features

Our Security Operation Center is located in We integrate 4 different functionalities in one
Rempoa and fully resourced. We are the only simple solution that it's easy to be deployed and
platinum partner of AlienVault in Indonesia. managed:
AlienVault is the leading Security Operation Center
software provider and is trusted by over 5,000+ Asset Discovery
clients across the world, including NASDAQ,
Mastercard, U.S. Airforce, Bank of Ireland, New Know who and what is connected to your
York Times and many others. environment at all times. Have a real time asset
inventory of all your hosts.
How does it work? Vulnerability Assessment
Automatically assess and find your vulnerabilities

Protergo Security Operation Center before an exploit or intrusion. Our team works
together with you to patch the most important
- installs agents into your servers to prevent issues.
security issues
Intrusion Detection
- installs agents into an appliance on your central
network switch to monitor the traffic that is Be alerted to suspicious activities with host and
detected in your internal network network intrusion detection system and cloud
intrusion detection system.
SIEM & Log Management
Correlate and analyze event data from across your

environment. Manage logs seamlessly.
Key Clients using this solution
Blue Team Service
1. b. Protergo Work From Home

Protergo WORK FROM HOME is an Endpoint Understand where your employees are
(mobile phone and laptop) Management solution
that gives protection and control over your Locate device GPS to solve stolen or lost devices
organization's corporate devices by enabling
secure access to the apps and data in it. Protego Control of the activities
WORK FROM HOME offers support for Android,
iOS, Windows (PC and Phone), macOS, and tvOS Remote view and control help admins
endpoints. troubleshoot the devices remotely.
Restrict functionalities
How does it work?
Selectively restrict device functionalities (e.g., usb,
websites, …)
Protergo Work From Home
Install/ Remove software remotely
- installs agent into employee's devices, BYOD or
corporate devices to protect against emerging Provision, deploy and manage mobile applications
threats and prevent security issue.
Ensure compliance
- offers services that include the remote
monitoring of the workforce. Check and enforce compliance across the entire
device fleet.
Basic security in place
Block unwanted URLs with Web Content Filtering.
Blue Team Service
1. c. Protergo Mobile Device Protection

Protergo Mobile Protection is a mobile cyber- - Protection from SMS & Social Attacks
security product that uses predictive AI
technology to identity and stop security threats. - Protection from Network Attacks
Protergo Mobile Protection's predictive protection
comes from its AI engine which applies learning - Protection from Mobile Malware
models to identify and stop emerging threats from
compromising corporate data. - Protection from Device Based Attacks
- Media Phishing Attacks (e.g., malicious

How does it work? images)
- Vulnerabilities & patch level details

- Protergo Mobile Protection installed on the
corporate or personal mobile devices to stop - Protect end user privacy with Secure DNS
security threats over HTTPS/TLS
- Protergo Mobile Protection uses Artificial - Deep visibility into OS

Intelligence (AI) actively on mobile devices to
monitor, learn and protect your corporate data and
your devices from emerging threats
Blue Team Service
1. d. Protergo Next Generation Anti-Virus

Protergo Next Generation Anti-Virus is an anti- - Static AI on the endpoint prevents attacks
virus program that offers unique characteristics in-line in real time
such as AI based control of virus. Protergo Next
Generation Anti-Virus does not use signatures and - Consistently ranked for highest efficacy and
is able to detect and block viruses as they spread. lowest false-positives
The unique selling point of Protergo's next
generation anti-virus is that Protergo is so - Surgically reversing and removing any
confident about this product that we will pay the malicious activity
ransom for you if any system is infected.
How does it work?
- As any normal anti-virus is installed into servers/

laptop and end-points
- It is then connected to a cloud system that allow

administration of the end-points including end-
point management
#1 French Over 40+ Leading Banks and #1 Airline

Banking Group Insurances around the World in Asia
#1 US Public #1 Oil & Gas Company

University in the World
Blue Team Service
1. e. Protergo Anti Data Loss Prevention

Protergo Anti Data Loss prevention is a cyber- - Avoid that confidential information and data
security product that uses predictive AI is sent outside the organization
technology to identify and stop the spreading of
confidential data from the computers of - Can block multiple type of data losses
employees to the outside world. attacks (Excel, email, database, etc.)
- Can block employees from sharing the data

How does it work? over email, web, sharing and chat programs
- Can block employees from sharing the data

Protergo Anti-Data Loss Prevention installed on over cloud such as Google Mail or Office 365
the corporate or personal mobile devices to stop
data losses
1. f. E-mail protection

Protergo Email Protection protects email from Protergo Email Protection helps you secure and
malware to keep your corporate protected from control inbound and outbound email.
information stealer.
With Email Protection, you can protect your
people, data, and brand from today's threats such
How does it work? as
- Impostor email
Protergo Email Protection installs an appliance - Phishing
connected to your email servers - Malware
- Spam
- Bulk mail
Red Team Service
PROTERGO RED TEAM SERVICES
Protergo offers two types of red team services
Penetration testing Vulnerability assessment
Why Penetration testing and Vulnerability assessment

are important?
It's critical to do vulnerability assessment and penetration testing.
Based on MENKOMINFO/No./11/2018, This is even more important now with

21/SEOJK.03/2017 and 38/POJK.03/2016 Banks digitalization. As banks and other companies are
are required to do penetration testing and digitizing, new features are introduced, such as QR
vulnerability assessment. Those are important for system, Cash in/out, Customer onboarding online,
banks and other institutions, so that attacks can Mobile/internet banking, Open Banking API, Third
be simulated, prevented and avoided. party data verification, Online loan opening and
many more. With those extensions it means that
Penetration testing and vulnerability assessment the threats coming from digital security is more
will guide the next action to fix IT systems and more relevant nowadays.
improvement. With Penetration Testing and
Vulnerability Assessment banks and other
institutions discover their own weaknesses on IT
systems, so they can take action to protect it
before someone malicious can get access to those
systems.
Red Team Service
What makes Protergo's penetration testing and

vulnerability assessment unique?
Protergo differentiates itself for Penetration testing and vulnerability assessment across 3 main dimensions:
Methodology People Track Record

which methodology do we use what are the human resources what are the previous projects
for penetration testing? involved for penetration testing? done by the team?
Why is Protergo's methodology Unique?
Protergo is the first in Indonesia to use a world- Best in class quality at the right prices. Forget the
class MITRE framework to define potential attack old extremely slow and manual penetration
scenarios. Based on real-world attacks used on testing, we use AI and Robotic Process
other financial institutions and before the Automation to speed-up the penetration testing.
penetration testing itself. With MITRE, Protergo is Higher quality using technology.
the first company in Indonesia to take very
seriously the human element, typically ignored by
penetration testing.
Red Team Service
Last but not least, we use proven world-class methodologies
MITRE ATT&CK® is a world-class knowledge base CVE® is a world standard for cybersecurity
for adversary tactics and techniques based on products and services from around the world,
real-world observations. The ATT&CK is used to such as the U.S. National Vulnerability Database
develop specific threat models that inform our (NVD).
penetration tests.
The benefit of using the MITRE attack framework
is to ensure that Protergo and the Clients spend
more time upfront to discuss about potential
scenarios before the penetration testing begin.
This allow the team to be much more focused Open Web Application Security Project (OWASP) is
during the penetration testing and ultimately give a nonprofit foundation that works to improve the
the Client much better and more realistic results. security of software. The OWASP Foundation is
Moreover, with MITRE, the human element is the source for developers and technologists to
taken into account since the beginning. So secure the web.
Phishing, Social Engineering attacks can be
simulated.
The NIST Cyber security Framework provides a

policy framework of computer security guidance
Offensive Security Certified Professional is the for how private sector organizations in the United
best-in-the-world ethical hacking certification States to prevent, detect, and respond to cyber-
offered by Offensive Security. attacks.
Protego's Penetration testing methodology,

it's based on the following steps:
Pre-attack Vulnerability Analysis

Spend time upfront to discuss the attack Identifying vulnerabilities and determining their
scenarios severity.
Scanning and Reconnaissance Exploitation

Getting to know the target using passive methods Gaining access by breaching security of a system
like researching publicly available information and or finding an bug to exploit in the software.
network scanning.
Post-Exploitation Reporting
Threat Modeling Detailing the vulnerabilities found and providing
A description or model of all the security concerns information on potential impact on the company if
and why they should be resolved. exploited.
Red Team Service
Why Protergo's approach to people is Unique?
We are the first one in Indonesia to use a local team combined with an international team of penetration
testing experts. See the following figures for the key details.
Local Indonesian Team International Team

Indonesian team carry-on Protergo hires a team of international
all the tests for Protergo penetration tester to cross-review the results
Have unique knowledge of Role of this team is to ensure the quality

the Indonesian context of the penetration testing is very high
Moreover, our penetration testers are certified by OSCP and OSWE. This allows Protergo to offer the
best in class penetration testing services to our Clients.
Penetration testing Advanced Web Attacks & Cracking the Perimeter

with Kali Linux (PWK) Exploitation (AWAE) (CTP)
Advanced Windows Wireless Attacks

Exploitation (AWE) (WIFU)
Red Team Service
Why is Protergo's track-record Unique?
Protergo has a strong experience in the banking sectors. Please find below some examples of the penetration
testing that we have completed over the past years
Sector Example of clients
Banking Digital Cash Mobile (Penetration Testing)
Banking Penetration Testing (Open API)
SOE Bank Penetration Testing, Vulnerability Assessment
SOE Bank Web Application Penetration Testing
Banking Internal Network Penetration Testing, Vulnerability Assessment
Banking Web Application Penetration Testing
Banking Web Application Penetration Testing (cash management system)
Banking Android Mobile Penetration Testing
Banking Web Application Penetration Testing
Banking Internal Network Penetration Testing, Vulnerability Assessment
Telco Internal Network Penetration Testing, web application
Get in touch
Jl. Rempoa Raya No.11, Rempoa,
Kec. Ciputat Tim., Kota Tangerang Selatan, Banten 15412
www.protergo.id

State of Cyber-Security in Indonesia

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

State of Cyber-Security in Indonesia

Uploaded by

Copyright:

Available Formats

CONTENTS

Welcome address 4 Top attacks by type 6

Deep understanding of cyber-security in Indonesia -the 1st in Indonesia to

International-know-how with Indonesian-roots - our security operation center

A ﬁnal word about us at Protergo. We started 2

2. 2019 Executive Summary

Top 6 must-know insights

2. Countries 5. Web exploits

Our 3 simple recommendations

2. Run annual penetration testing and quarterly vulnerability scanning

Protergo Cyber-Security Team

3. Analysis of top attacks by type

In 2019, 5 main types of attacks to Indonesian

Policy & access violations

Top attacks by type

Vulnerability Policy & Access Violations

3.a Analysis of top Malware by type

Chart 2: Top malware by type

Client Side Exploit - Backdoor — DoublePulsar

Trojan infection — Glupteba Trojan infection — Virut DGA

3.b Analysis of top Exploit by type

90% of the Exploit are either Server Attacks or SMB vulnerability

Chart 3: Top Exploit by Type

Server Attack (DOS & DDOS) SMB Exploit

SQL Injection Phishing

SSL Attack Web attack (Cross Site Scripting – XSS)

3.c Network Attacks

A network attack is made to gain unauthorized access to the

Chart 5: Top vulnerability by type

System Scanning Software Unpatched

3.e Category and policy violations attacks

Policy & violation are

Access Violation Non Brute attack

Policy violation is the internal act that bypasses or

4. Top attacks by country of origin

Protego has reviewed all the top attackers in Indonesia by country.

Distribution of attack sources by country - January to December 2019

49.80% USA 2.43% Germany 0.39% Denmark

10.25% Russia 1.08% Singapore 0.36% Uruguay

5.84% Netherlands 0.91% France 0.24% Mexico

5.55% Indonesia 0.81% Romania 0.12% Thailand

5.37% China 0.59% Sri Lanka 0.08% Poland

5.20% Australia 0.52% India 0.04% Spain

3.62% Samoa 0.50% England 0.03% Sweden

3.23% Italy 0.46% Canada 0.03% South Africa

USA The attacks from the USA are typically focused

Russia The attacks from Russia top attacks’ are slightly

10% Network Attack

Netherlands And from Netherlands the most common

5. Analysis of key vulnerability in 2019

5.1 The average organization had over 100 vulnerabilities;

Average number of key vulnerability by type for a typical organization

5.2 Within the critical/ high category, over 50% of the

Web application/ PHP PHP 53%

5.3 30% of the key vulnerabilities are 3 years old but

Analysis of distribution of key vulnerabilities by year

Older than 2008 2%

Protergo delivers cyber-security

Blue team services

a. Security Operation Center

b. Work from Home

d. Mobile Device Protection

g. Email Protection a. Vulnerability Assessment