ONEMi is one of its kind digitally-enabled platform operated by ONEMi Technology Solutions Private Limited with a vision to provide speedy and hassle-free credit financing to its customers across India. ONEMi Technology Solutions Pvt. Ltd came into existence in the year 2015, intending to open up new vistas in consumer credit financing for online as well as offline purchases using the latest technology as an aid. Our constant efforts to financially empower our customers led us to be present across various segments of business such as Online Purchase Loan, Personal Loan, and our newest offering - “Revolving Line of Credit.” ONEMi Technologies (ONEMi) is engaged in merchant acquisition / tie-ups, development of credit gateway technology, assessing the creditworthiness of the customers. Onemi Technology uses its proprietary software, algorithm, and credit marketplace platform for provisioning instant consumer loans through their financing partners. However, the entire credit assessment, KYC processing, credit approval, financing of consumer loans for the purchase of goods and services from online and offline channels is taken care by RBI-registered NBFCs tied up with ONEMi. The process of collection of repayments and EMIs is undertaken by ONEMi and NBFC partners through registered intermediaries.

Wissen Baum Software Solutions is leading company in Cyber security area, with ISO 27001:2013 Compliance. Its presence in Asia, Middle east, South Africa, Europe and Northern America. We work in area of Asset lifecycle management, Network security, Threat Intelligence, Incident detection and response and SOC response to provide our clients best in class Cyber security.

It is agreed that Wissen Baum will assist ONEMi in area of Cyber security to enhance ISO 27001 framework. A one day onsite/offshore semi audit was conducted and performed CAS assessment through NASMS (Network Asset Security Management System) leading Cyber security software and SME's (Subject Matter Experts) from Cyber security domain.

In our study the emphasis is given to the following four Asset categories namely Hardware, Software, Communication and Cloud the details is given in the below table 3.1.

Network architecture is the design of an organization IT infrastructure. It is a framework for the specification of a network's physical components and their functional organization and configuration, its operational principles and procedures, as well as communication protocols used.

The below figure 3.2 signifies that asset network structure on ONEMi Technology. The network communication begins through ISP (Internet Services Provider) It transmit the Internet into firewalls (SonicWall HA 3700) for primary and secondary connections. Cisco Core Management switch distributing the internet services to different mode of network switches such as Power over Ethernet (POE), EPBAX, Access point POE and DVR. These network products distributing the data services with current VLAN segmentation to all end points such as desktop computers, laptop computers, printers and other resources. Ring office data centre have communicating with different geolocation call centres in Mumbai.

The below table 3.3 shows, server types, server details and locations at ONEMi Technology. The Webserver, Application server, Data server and Windows patch servers are hosted in AWS cloud. The mail server is G-Suite work place and hosted at Google cloud. The organization is accessing most of its applications, data bases from AWS cloud.

Sr.No	Server Types	Details	Location
1	Web Server	S3 Bucket published	AWS
2	Application Server	Virtual private cloud	AWS
3	Database Server	AWS RDS MYSQL	AWS
4	Patch update	AWS Guarduty	AWS
5	Email Server	Gsuite	Google
6	File Server	Dropbox and Gsuite	Google
7	Proxy Server	Gsuite	Google
8	Internet Relay Chat Server	Microsoft Teams	Microsoft
9	Fax Server	NA	NA
10	Groupware Server	NA	NA
11	News Server	NA	NA
12	List Server	NA	NA
13	Telnet Server	NA	NA
14	Windows	NA	NA
15	Streaming Server	NA	NA
16	FTP Server	NA	NA

Table 3.3 Server Overview Information

The below table 4.1 represent overview of Internet Service Provider (ISP) information on ONEMi (Ring shop floors). There are two Internet Service Providers which is giving the internet services via MUX and Ring network topology. To provide a high availability internet connection, both ISPs manage load balancing and failover WAN feasibility.

Sr No	ISP Vendor Name	IP Ranges	Subnet Mask	Connection Type	Primary DNS
1	Tata Telecom Service	123.252.170.186/30	255.255.255.252	Primary	8.8.8.8
2	Vodafone Idea Service	123.63.171.122/29	255.255.255.248	Secondary	8.8.8.8

Table 4.1 Internet Network Services

Internal and external network connection at ONEMi is depicted in figure 4.3 below. There are two Internet service provider (ISP) available in the system and the IP ranges are shown below. Core network switch carry the internet connections through two ISP. The entire endpoint network is connected to the default VLAN, which is provides services to network management switches and POE (Power over Ethernet). The default VLAN's IP range from 192.168.48.1 - 192.168.55.254.

Figure 4.3 Network IP Flow

The figure 4.4 depicts the distribution of configured VLAN on ONEMi network. The high availability SonicWall Firewall is centrally managing the VLAN distribution through Cisco Core switch.

Figure 4.4 Network VLAN Distribution

VLAN has been configured in three interfaces X0, X1, X2 on the Cisco core switch and its centrally distributing the network traffic to entire network products and end points as given in the figure 4.3 Network IP Flow.

It is strongly recommended to configure department and functional groups with additional VLAN segmentations (Currently 3 in place). The isolation techniques must be selected based on a risk management perspective that balances the threat, the information being protected, and the cost of the options for protection. Architectural and design decisions should be guided and informed by the security requirements and selected solutions. The NIST SP 800-160-1 guidelines should be referred.

The below figure 4.10.1 and 4.10.2 depicts the top utilization connection from source and destination IPs. Figure 4.10.1 shows that source IPs 14.96.1.97 (Tata Telecom) utilized durations is 120, 108.158.61.95 (Cloudfront) utilized durations is 98, 23.211.217.233 (Akamai Technologies Inc) utilized durations is 69. Figure 4.10.2 shows that top destination IPs 123.252.170.186 (Tata Telcom) utilized durations is 1724, 123.63.171.122 (Vodafone Idea) utilized durations is 1536, 192.168.48.1 (Kissht Internal) utilized durations is 84.

Figure 4.10.1 Top Source IP - Durations

Figure 4.10.2 Top Source IP - Durations

Duration traffic illustrates that Business relevance traffics are Vodafone idea, Tata Telecom, Cloudfront, Akamai technologies in places and Non business relevance traffics in place such as Facebook, Telegram.

NIST SP 800-137 framework defined Security-related information obtained from monitoring is analyzed and met with appropriate responses. Response to findings at all tiers may include risk mitigation, risk acceptance, risk avoidance/rejection, or risk sharing/transfer, in accordance with organizational risk tolerance.

Strongly recommended to continues monitor network traffic activities to establish the detect and response from several attacks.

The below figure 4.11 represent the analysis of vulnerable ports traffic transactions. Network VLAN interfaces X0, X1, X2 establishing the all IP and port traffics through the firewall. Based on vulnerable ports analysis, detecting some intrusion port traffics, those ports are circle marked in the below figure.

22 (ssh) 54.87.144.97 (Amazon.com), 23 (telnet) 193.142.146.214 (Colocation Datacenter), 25 (smtp)104.152.52.73 (Rethem Hosting LLC), 21 (smtp)104.152.52.56 (Rethem Hosting LLC), 445 (smb) 5.62.53.136 (avast.com), 53 (DNS) 104.152.52.57 (Rethem Hosting LLC).

Figure 4.11 Vulnerable Port Traffic Analysis

Customer shall enforce traffic crossing the network boundary should be in compliance with the NIST SP 800-171R2 standard for the protocol in question and using the appropriate well known port. If the port or protocol is not known the traffic should be blocked.

It is strongly recommended to restrict, disable or prevent the use of nonessential ports.

The below figure 4.12 depicts the internal and external traffic connection through vulnerable ports. Network traffic IP connections are indicated with colour code such as internal traffic is marked in colour green and external traffic is marked in colour red shown in the figure below.

Figure 4.12 Port vs IP Connections

Above figures illustrates that known vulnerable ports traffic have established business relevance transactions through the ports 445_smb, 25_smtp, 3389_RDP, 21_ftp, 22_ssh, 53_dns, 23_telnet.

Customer shall enforce traffic crossing the network boundary is in compliance with the NIST SP 800-171R2 standard for the protocol in question and using the appropriate well-known port. If the port or protocol is not known the traffic should be blocked.

It is strongly recommended to use secure protocols that can provide encryption of both passwords and data (e.g., SSH, HTTPS); do not use less secure protocols (e.g., telnet, FTP, HTTP) unless absolutely required and tunnelled over an encrypted protocol, such as SSH, SSL, or IPsec as per NIST SP 800-123 (General Server Security).

The cross-product of analysis between source and destination ports Connection vs. bytes utilization is displayed in the figure 4.13 below.

Figure 4.13 demonstrates that highly consumed source port is 443 (tcp-https), connections is 1701 and bytes is 648725. Figure 4.13 demonstrates that highly consumed destination port is 443 (tcp-https), connections is 108 and bytes is 16876.

Figure 4.13 Traffic Through Ports

Above figures illustrates that top port 443(https) traffic have established through business relevance transactions.

Customer shall enforce traffic crossing the network boundary is in compliance with the NIST SP 800-171R2 standard for the protocol in question and using the appropriate well-known port. If the port or protocol is not known the traffic should be blocked.

The cross-product of analysis between source and destination IPs Connection vs. bytes utilization is displayed in the figure 4.14 below.

Figure 4.14 demonstrates that highly consumed source IP is 14.96.97.120 (Tata Telecom) and bytes is 167682, connections is 120 and highly consumed destination IP is 123.63.171.122 (Vodafone Idea ISP) and bytes is 521677, connections is 1536.

Figure 4.14 Top Source IP - Connection vs Bytes

Source and destination IPs are highly consuming connection and bytes through two Internet Service Providers (Tata Telecom and Vodafone Idea).

The below figure 4.15.1 provides the analysis of Top events for overall utilization of Source IP vs Destination IP and Source port vs Destination port. Figure 4.15.2 represent that non business hours traffic

Figure 4.15.1 Top Events traffic analysis - Timeline

Figure 4.15.2 Non-Business

SonicWall Firewall is effectively addressing the non-business hours transactions such as malicious traffic, incorrect addresses in the packet headers (Spoofing attacks), Authenticating external traffic before allowing traffic to pass as per NIST SP 800-41 RE1 (Packet Filter).

High utilization source IP traffics is 1.1.1.1 (Cloudflare DNS), 5.189.183.129 (ISP services), 157.240.237.60 (WhatsApp) and Top destination IP transactions is 123.252.170.186 (Tata Telecom Services). Non business relevance traffic occurred at 18th hour such as WhatsApp.

As per NIST SP 800-137 framework define Security-related information obtained from monitoring is analyzed and met with appropriate responses. Response to findings at all tiers may include risk mitigation, risk acceptance, risk avoidance/rejection, or risk sharing/transfer, in accordance with organizational risk tolerance.

Strongly recommended to continues monitor network traffic activities to establish the detect and response from several attacks.

Figure 4.16.1 shows that per day network traffic signature analyse includes utilization of bytes, connections, duration during business and non-business hours in a day.

The table 4.16.2 below summarises non-business hours traffic from various participants, including source IP, destination IP, source port, destination port, and consumed Bytes.

Figure 4.16.1 Average Day traffic

Table 5.1.1 below demonstrates the secure rule and malicious rule analysis in the SonicWall firewall. Rule no. 7 and NAT policies 19, 21 has configured to perform the security activities such as LAN to WAN traffic, Attacks monitor, Content filter, IP spoof detect, Port scan possible, Website block.

The table below 5.1.2 Firewall malicious traffic rule shows that allowing traffics social media and Ecommerce website such as Facebook, Twitter, WhatsApp, Telegram, Alibaba.com through 443, 80 ports. This is suspicious and chances of Cyber-attacks such as Ransomware, DDoS (Distribution denial of service), Botnet activities, etc.

Rule	NAT Policy	Source Interface	Destination Interface	Rule Service	Group	Action
7	19	X0	X2	Security	Content Filter	Drop
7	21	X1	X1	Security	Content Filter	Drop

Table 5.1.1 Firewall Secure Rule

Rules	Rule Description	Source Interface	Destination Interface	Source IP	Destination IP	Status	Risk Impact	Action
NA	NA	X2	X2	91.108.56.154	123.63.171.122	Allow	High	URGENT
NA	NA	X0	X1	192.168.52.196 / 170 / 215 / 191 / 37	31.13.79.18 /53 /54	Allow	High	URGENT

Table 5.1.2 Firewall malicious traffic

Domain Name System (DNS) filtering services to help block access to known malicious domains in place.

NIST SP 800-137 framework defined Security-related information obtained from monitoring is analyzed and met with appropriate responses. Response to findings at all tiers may include risk mitigation, risk acceptance, risk avoidance/rejection, or risk sharing/transfer, in accordance with organizational risk tolerance.

The table below recommends some preventing action plans based on observations made through asset management, network analysis and firewall rules.

As per NIST, Weakness in an information system, system security procedures, internal controls or implementation that could be exploited or triggered by a threat source.

In our case study performed vulnerability analysis for five assets from different departments such as IT, Development, HR, Accounts and Legal. The below tables 6.1 shows that software vulnerability report.

Sr.No	Product	Product Version	CVE Number	CVSS Version	CVSS BaseScore	Description	Endpoint Host	Team
1	VLC media player	3.0.8	CVE-2019-18278	3.1	7.8	When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at libqt_plugin!vlc_entry_license__3_0_0f+0x00000000003b9aba. NOTE: the VideoLAN security team indicates that they have not been contacted, and have no way of reproducing this issue.	DESKTOP-LOVMVNK	Developer
2	WinZip	9	CVE-2007-0264	2	6.6	Buffer overflow in Winzip32.exe in WinZip 9.0 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long command line argument. NOTE: this issue may cross privilege boundaries if an application automatically invokes Winzip32.exe for untrusted input filenames, as in the case of a file upload application. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.	DESKTOP-LOVMVNK	Developer
3	WinZip	9	CVE-2004-1465	2	3.7	Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors, including the command line.	DESKTOP-LOVMVNK	Developer
4	HP Update	5.005.002.002	CVE-2015-5442	2	4.6	Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.	DESKTOP-3F5BFM2	Account
5	Adobe InDesign 2023	18	CVE-2023-21592	3.1	5.5	Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	DESKTOP-LOVMVNK	Developer
6	Adobe InDesign 2023	18	CVE-2023-21591	3.1	5.5	Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	DESKTOP-LOVMVNK	Developer
7	Adobe InDesign 2023	18	CVE-2023-21590	3.1	7.8	Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	DESKTOP-LOVMVNK	Developer
8	Adobe InDesign 2023	18	CVE-2023-21589	3.1	7.8	Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	DESKTOP-LOVMVNK	Developer
9	Adobe InDesign 2023	18	CVE-2023-21588	3.1	7.8	Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	DESKTOP-LOVMVNK	Developer
10	Adobe InDesign 2023	18	CVE-2023-21587	3.1	7.8	Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	DESKTOP-LOVMVNK	Developer
11	McAfee LiveSafe	16	CVE-2017-3898	3	5.9	A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS) versions prior to 16.0.3 allows network attackers to modify the Windows registry value associated with the McAfee update via the HTTP backend-response.	LAPTOP-SOKU6N51	legal
12	McAfee LiveSafe	16	CVE-2017-3897	3	9.8	A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3 allows network attackers to perform a malicious file execution via a HTTP backend-response.	LAPTOP-SOKU6N51	legal
13	Total Protection	16	CVE-2022-43751	3.1	7.8	McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges.	LAPTOP-SOKU6N51	legal

Table 6.1 Software Vulnerability Report

As per software vulnerability analysis, observed that overall software's are updated versions and patched in ONEMi assets.

As per NIST SP 800-137 Each system, including all servers and end points that are part of the system, should be protected based on the potential impact to the system of a loss of confidentiality, integrity, or availability protection measures (otherwise known as security controls) tend to fall into two categories. Security weaknesses in the system need to be resolved. If a system has a known vulnerability that attackers could exploit, the system should be patched so that the vulnerability is removed or mitigated.

Recommended to validate the possible software vulnerability in the given table and perform vulnerability assessment as per NIST SP 800-137 and NIST SP 800-18 Rev.1 controls.

The below figure 6.2 shows software vulnerability score analysis through installed software list in the ONEMi network assets.

As per NIST Vulnerability management, An ISCM capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network.

The below table shows the top-ranking complexity vulnerabilities found on various software installed on ONEMi asset end points.

Figure 6.2 Software Vulnerability score Analysis

The below figure 6.3 shows the top-ranking complexity vulnerabilities in percentage found on various software installed on ONEMi asset end points.

Figure 6.3 Software Vulnerability in Percentage

The below table 7.0 shows that condition of health Asset management followed by business impact and risk impact. A detailed brainstorming session should be conducted to review Assets conditions and an effort should be made to improve or maintain these Assets conditions.

Sr.No	Categories	Condition	Business Impact	Risk Impact	Recommendation
1	Access Control	Good	Moderate	High	Keep Access Control for Various security Levels. Monitor Access Control Lock Regularly
2	Asset Management	Average	High	High	Thorough Asset Management Activity should be performed
3	Firewall Management	Poor	High	High	Thorough Network Traffic Activity should be performed
4	Network Architecture	Average	High	High	Thorough Network Architecture Studies should be performed
5	Cloud Server Management	Good	High	Low
6	Communication Management	Poor	High	High	Observed various communication platforms. If possible, reduce multiple communication platforms
7	External Traffic Management	Average	High	High	Observed objectionable external traffic with malicious ports
8	Response Planning	Average	High	High	Thorough Response Planning should be developed and deployed
9	Risk Assessment	Not Known	High	High	Thorough Risk Assessment should be performed
10	Risk Management Strategy	Not Known	High	High	Thorough Risk Management Strategy should be developed and deployed
11	Governance Management	Not Known	High	High	Thorough Governance Management Strategy should be developed and deployed
12	Anomalies Detection Management	Average	High	High	Continuous Anomalies Detection should be performed
13	Security Continuous Monitoring	Not Known	High	High	Thorough Security Continuous Monitoring should be developed and deployed
14	Training and Awareness	Not Known	High	NA	Regular Training and Awareness programs should be conducted

Table 7.0 Cyber Security health check

The current CAS at ONEMi gives an overview about the cyber security condition at ONEMi. This CAS is addressing ever evolving aspects of cyber security framework such as Asset management, Current Business Environment, current governance, current Risk Assessment, Data Security, Anomalies, Risk mitigation, Response planning, Recovery planning and communication. This POC also aimed at understanding the aspects of business relevance processes with focus on Availability, Integrity and Confidentiality.

The analysis of Asset management shows that most of Assets are managed in Cloud. The Failsafe data mechanism should be reviewed in order to maintain the Availability of data.

There are few redundancies in system in form of Software, hardware, IP etc. This gives an opportunity for cost optimization through continuous monitoring of Assets for minimum period of 6 months.

The cyber security people Asset need additional bandwidth. This can be created by hiring additional resources. The minimum team size of 4 is recommended.

The detailed analysis of Network Security has identified 2 rules and 4 NAT Policies which can lead to risks such as Ransomware attack, DOS, Botnet attack etc. The analysis shows that various non-business relevant activities with higher risk impact are taking place through internet. The details of same are mentioned in section 5.1.

The various recommendations are given in section 5.2 and 5.3 should be implemented as soon as possible. NASMS tool has also given the Auto generated Firewall rules its available in the html report. These Rules should be evaluated and implemented in Firewall rule sheet.

The detailed analysis of vulnerabilities at Software level has been performed. These vulnerabilities are given in section 6.1. These vulnerabilities should be reviewed with internal team and mitigation based on priorities should be initiated.

As the term cyber security is continuous term and needs continuous monitoring of cyber security using Network detection and response followed by vulnerabilities management.

The overall observation through this CAS recommended bringing in place a Security Operations Center (SOC) to monitor, prevent, detect, investigate and respond to cyber threats around the clock. SOC teams are charged with monitoring and protecting the organization's assets including intellectual property, personnel data, business systems and brand integrity. The smart dashboard gives the analysis of proactive operations such as Asset monitoring, Network traffic analysis, Vulnerability analysis, Threat intelligence summary, Account management summary, Authentication summary and Email and malware summary for 24x7 incidents and notifications.

In the end, we would like to conclude this CAS report with Marcel Proust classical saying “We don't receive wisdom; we must discover it for ourselves after a journey that no one can take for us or spare us.”