IT Aduit & Assessment - Case 2

One of the market leading travel agencies in Hong Kong

Size
100+ Employees

Service
IT Audit and Technical Assessment Service

Challenge
Under the revolutionary technologies change in the recent decade, our client is one of the many in such industry, which undergo a transformation from manual operation to machine based operation for specific repetitive tasks. The automated programs are functioning 24 hours a day, 7 days a week nonstop. With the existing infrastructure set up, transiting and hosting such huge amount of automated programme would raise both management and security issues.

To tackle any serious incidents before it happens, the IT management has turned to our IT Audit and Technical Assessment service for evaluating existing vulnerabilities and risks within the system, infrastructure and daily operations.

Result and Follow-up
RSEL provided IT audit and technical assessment service towards the client’s IT infrastructure and daily operation focusing on information security. The auditing area of assessment are mainly focused on the information security aspect on:
•    IT Structure
•    IT Operation
•    System Infrastructure and Architecture
•    Network Infrastructure and Architecture.

Together with the audit assessment, a vulnerability scan assessment is also conducted towards the official webpage so as to determine if an eternal hacker can penetrate the system and network infrastructure.

Audit Report and Vulnerability Assessment Report submitted to the management includes the findings of vulnerability and risk, impact of related risk, priority of improvement and practical recommendations. With the road map and action plan included according to the seriousness of the observation found, our client could be able to include the follow up action needed in their IT year plan to tackle the corresponding risk.

Result
With the submission of the management report of our findings, impacts, severity levels and recommendations, a meeting is held with the management team to run through each finding, some includes:
•    Identification of security holes within their multi-sites setup in both network and application aspects.
•    Core business ERP system running a 2-tier hierarchy, any users may delete all system data under a press of the delete button.
•    Insufficient and ineffective configurations of firewall causing managers’ personal desktops and servers vulnerable to hackers.

Follow-up
Reduce potential security holes with an up-to-date centralized monitoring and administration system. Temporary work around method to protect data. Awareness of new options in ERP systems with pertinent professional advice. Establishment of new policies and procedures in protection of the company.

Our team thereafter, proposes a range of IT services providing a one stop solution of our client. Some of our services include:
•    Immediate handling of high severity objects to minimize risks including firewall configurations and ERP data protection.
•    In-place a centralized administration and network monitoring systems to govern and simplify IT administration.
•    Sources different options of ERP’s providing pertinent professional advice.
•    Establishment of new policies and procedures in protection of the company.

Benefit
After the running of our IT Audit and Services Scheme, the workload is centralized and eased by the new establishment of administration and network monitoring systems. The management team has much of a better overview of IT and the current environment in both security and business growth aspects. With the establishment of policies and procedures, a clear guideline is defined and a regular communication channel between management and IT is established.

More Updates

The statement "Certain industries will be replaced by AI" is only half true. While AI will indeed replace a significant amount of "work content," it is rare for an entire industry to vanish across the board. Instead, industries are undergoing internal division of labor, restructuring, and upgrading. Replacing Functions, Not All Roles Multiple economic studies indicate that AI will impact approximately 40% to 60% of jobs. In these cases, some processes will be automated, while others will see productivity boosted by AI. Highly repetitive tasks—such as data entry, basic customer service, and routine report writing—are easily taken over by AI. However, the same industry will simultaneously create new roles focused on supervising AI, designing processes, and integrating systems. The Risk is Real, But It’s Not Doomsday Analysts estimate that AI and automation may "expose" hundreds of millions of jobs to replacement risks, particularly in white-collar administration, customer service, and certain areas of programming. At the same time, research from the World Economic Forum and major banks predicts that AI-related transformations will create new job categories. These include machine learning engineers, AI safety and ethics experts, and digital transformation consultants. Why Humans Retain the Advantage Currently, AI excels at standardized, predictable, and data-driven tasks. For work requiring empathy, complex communication, cross-domain judgment, and creative strategy, AI remains a tool for assistance rather than a total replacement. Many studies emphasize that "Human-Machine Collaboration" will become the mainstream model: Humans set the direction, make decisions, and bear responsibility, while AI handles calculation, generation, and analysis. How to Respond: Don't Fear Replacement, Learn to Utilize It The group facing the highest career risk is often not "people affected by AI," but "people who don't know how to use AI." Within the same job function, individuals who master AI tools will possess significantly higher productivity and competitiveness than their peers. Practical actions include: Learning to deconstruct work into automatable and non-automatable components. Mastering at least one AI tool (e.g., Generative AI, RPA, Data Analysis). Strengthening "non-programmable" capabilities, such as communication and problem definition. Personal Perspective: Reframe "Displaced" as "Restructured" Instead of asking, "Will Industry X be replaced by AI?" you should ask: "Which part of this industry's value chain is most susceptible to automation, and can I position myself on the side that designs and controls these systems?" Thinking this way offers far more actionable value than abstractly worrying about being "replaced."

Speed Without the Sprawl

Leveraging OutSystems' rapid development strengths, our team achieves true Agile development, focusing intensely on user requirements. However, requirements are never fixed; they take time to refine within the project's cycle. If a developer simply builds projects based on the initial requirements, it leads to significant rework when those requirements are inevitably revised. This creates serious technical debt that can derail a project's schedule. To combat this, we strictly follow the OutSystems Canvas Design architecture to define each module's usage and content. We generalize logic into foundational modules, optimizing reusability and providing high adaptability when requirements change. This approach allows us to eliminate complicated dependencies—avoiding the deployment nightmares that plague monolithic systems. The Real-World Challenge: "The Spaghetti Monolith" We’ve all seen it. A project starts fast. The "Idea-to-App" time is record-breaking. But as sprints pass and requirements evolve, the "interest rate" on technical debt spikes. Suddenly, changing a simple UI element breaks a core business process because the logic was trapped inside the screen. Deployment becomes a "big bang" event where everything must go live at once because of circular dependencies. In our team, we don't just "code fast"; we architect for resilience. Our Solution: The 4 Layer Canvas Strategy We treat the 4 Layer Canvas not just as a suggestion, but as our structural imperative. Here is how we use it to handle volatile requirements:  Isolating Volatility (End-User Layer): We keep our User Interfaces (UI) and interaction logic in the End-User Layer. This layer is highly volatile—it changes constantly based on user feedback. By isolating it, we can redesign a "Customer Portal" without risking regressions in our core business rules.Stabilizing Business Logic (Core Layer): We abstract our entities and business rules into the Core Layer. This is the backbone of our factory. Whether the data is accessed by a Mobile App, a Web Portal, or a Timer, the validation rules remain consistent. This promotes the "Don't Repeat Yourself" (DRY) principle.Enabling Independent Deployments: By using Service Actions (Weak Dependencies) in our Core layer, we decouple our modules. This allows different squads to deploy changes independently without forcing a factory-wide refresh—a critical enabler for our CI/CD pipelines.The Governor: AI-Driven Architecture How do we ensure we stick to these rules when moving at Agile speeds? We don't just rely on manual code reviews; we use the AI Mentor System. This tool acts as our automated architect. It scans our entire factory to detect architectural violations that humans might miss, such as: Upward References: Preventing foundational libraries from depending on business logic.Side References: Ensuring our End-User apps don't tightly couple with one another.Circular Dependencies: Identifying the "deadly embrace" between modules that locks deployments.The AI Mentor System quantifies this debt, allowing us to pay it down proactively before it hinders our release velocity. Join a Team That Values Architecture In our Taiwan office, we believe that low-code doesn't mean "low-architecture." We are building resilient, composable enterprise ecosystems that can scale. If you are a developer who cares about structural integrity, clean code, and mastering the art of OutSystems architecture, we want to hear from you. 

𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗶𝘀 𝗲𝘃𝗲𝗿𝘆𝘄𝗵𝗲𝗿𝗲 𝗻𝗼𝘄

Does the following screenshot look familiar to you? Calendar invites that seem to appear out of nowhere in Microsoft Teams or Outlook, asking you to “review important information” or “resolve an account issue”?A phishing campaign has been found abusing Microsoft Teams calendar invites to deliver malicious links and files directly onto users’ calendars. These events often mimic Microsoft notifications, come from odd or external addresses, and include attachments such as .htm or .js files that, when opened, they can lead to credential theft, malware installation or even full remote access for the attacker.With phishing tactics evolving so quickly, ongoing awareness training remains critical and essential. Effective programs use realistic phishing simulations combined with targeted training to help employees recognize and report suspicious emails quickly, turning them into an active detection layer alongside your technical controls.At Ringus, we offer phishing simulation assessment services, with the following key features:💫Tailor-made realistic phishing templates💫Flexible campaign duration and cadence💫Comprehensive reporting and analytics with insights