Berezha Security Group

BACKGROUND

Introduce your business and what you do there.

I’m the information security manager at a software development company.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Berezha Security?

We needed our annual penetration testing done. We also had some internal challenges, such as educating our employees, that needed attention.

SOLUTION

What was the scope of their involvement?

Berezha Security performed a full black-box test. They performed SSID coding, created a fake WiFi network in an attempt to get employee credentials, conducted encryption of laptops, and “hacked” us to test our security. Their team prepared fake websites to catch any phishing and tested our endpoint protection, providing a detailed report of their findings to help us understand any breaches we had.

What is the team composition?

Vlad (VP of Business Development) was the project manager and point of contact. There were a few engineers as well.

How did you come to work with Berezha Security?

Berezha Security is a well-known company in the area. Also, I’ve known Vlad for many years and worked with him on many projects.

What is the status of this engagement?

We worked together from March 2018–March 2020.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We like the high-quality level of their work. Their specialists are certified, enabling us to show proof that our penetration testing was done by professionals.

How did Berezha Security perform from a project management standpoint?

They’ve always met deadlines on every project. Their team fully achieved our requirements.

What did you find most impressive about them?

Their unique approach sets them apart from other companies. Berezha Security develops their own scripts and their standard scanners can be blocked. They have vast technical knowledge and are able to find a lot of issues using different resources.

Are there any areas they could improve?

Their system has missed some smaller, less-critical yet important breaches. If they were to scan first, they might find those breaches to report.

BACKGROUND

Please describe your company and your position there.

My role is the Security Engineer in the online educational startup platform.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

White-box Security Assessment of the mobile application, web services, and IT infrastructure

What were your goals for this project?

Our goal was to make an external security assessment before starting a bug bounty program.

SOLUTION

How did you select this vendor?

We select Berezha Security as a vendor of security assessment services after comparing it with similar companies.

Describe the project in detail.

Scope of work was next: Security Assessment of the mobile application and the web service(White-Box Application Security Assessment, Web Application, API web service, and mobile application), Security Assessment of IT infrastructure(Cloud Security Configuration Review).

What was the team composition?

Their team for our project consisted of 6 members.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They did a good job and on output, we got reports with security-related issues missed by us.

How effective was the workflow between your team and theirs?

Our communication was easy and effective.

What did you find most impressive about this company?

Autonomous of their team.

Are there any areas for improvement?

I can't say because it was the first security assessment of our company that's why I don't have enough data to compare.

BACKGROUND

Please describe your company and your position there.

I’m a CISO at a software development and IT consulting company. Our customers are citizens of the European Union.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We hired them to conduct an application security awareness training

What were your goals for this project?

Our goal was to to help our development teams increase level of application security awareness

SOLUTION

How did you select this vendor?

By recommendation

Describe the project in detail.

The goal of this project was to increase application safety awareness in our team. Training developers to work with tools for penetration testing

What was the team composition?

The team consisted of a security professional from Berezha Security’s side and our developer team.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Berezha Security conducted an excellent training. Demonstrated the work of various penetration testing tools. Introduced a team with new frameworks.

How effective was the workflow between your team and theirs?

They had a very effective workflow. Specialist from Berezha Security was very responsive and the best speaker.

What did you find most impressive about this company?

This is a great team made up of excellent security professionals. Very deep understanding of what they are doing.

Are there any areas for improvement?

No, not that I recall.

BACKGROUND

Introduce your business and what you do there.

I'm the director at a tech startup.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Berezha Security?

We needed to improve the security of our platform.

SOLUTION

What was the scope of their involvement?

Berezha provided cybersecurity services, including a security assessment of our web app and penetration testing.

What is the team composition? 

I worked directly with two people, including Vlad (Co-founder, Berezha Security).

How did you come to work with Berezha Security?

We'd been working with them prior to when I came on board, but I believe it was a reengagement based on the company's previous experience working with them. 

What is the status of this engagement?

The most recent project began in May 2019 and, although the penetration test was completed, we have a 60-day grace period remaining on our contract for ongoing support as needed. 

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Berezha was able to find a handful of areas on our platform we needed to fix and has even provided solutions for how to approach them. Overall, their efforts have been very valuable.

How did Berezha Security perform from a project management standpoint?

They're very responsive, accessible, and clear in communications. They thoroughly document their work and go out of their way to answer any questions we have or let us know when anything critical needs to be addressed. 

What did you find most impressive about them?

They're extremely focused on mitigation and actually provide concrete solutions. Rather than just pointing out where our platform is broken, they offer valuable feedback around how we can fix it. 

Are there any areas they could improve?

No. Although it was my first time working with them, it's been great overall. 

Do you have any advice for potential customers?

Don't be afraid to communicate with them in detail; they're always ready and willing to offer feedback. 

BACKGROUND

Please describe your company and your position there.

I’m the information security director at a software development company with more than 8,000 employees headquartered in the US and Ukraine.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

Our company is continually growing, and we had customer demand to run company-wide penetration testing through a third-party vendor, so we hired Berezha Security to perform independent validation of our network security.

What were your goals for this project?

In addition to our ISO27001 certification, we wanted to evaluate our security from an ethical hacking perspective and obtain a penetration test report that we can show to our enterprise clients.

SOLUTION

How did you select this vendor?

We selected Berezha Security from a global list of cybersecurity vendors.

Describe the project in detail.

Once we selected the vendor, we had a few meetings. After signing an agreement, Berezha Security began penetration testing and provided quick responses during the whole project. The report was conducted in three weeks, and we had a chance to fix issues. They also re-checked things for us for free.

What was the team composition?

From our side, we began with a security operations team and IT representatives that we ready to fix things. Berezha Security’s team lead managed our progress and added a few penetration testing specialists to the project.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They did an excellent job and produced result from the very start. I can recommend them as a trusted partner for any kind of security services.

How effective was the workflow between your team and theirs?

It was easy to communicate with them. We received quick responses to any questions related to their findings.

What did you find most impressive about this company?

I'm impressed by the Berezha Security’s speed, maturity, and readiness to provide additional advice free of charge.

Are there any areas for improvement?

Having a web portal that allows tracking, reporting, closing, and re-checking will improve user experience a bit.

BACKGROUND

Please describe your company and your position there.

I’m an IT Director at a software development and IT consulting company. Our clients are well-known companies in the US and Europe.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We needed to fulfill security requirements in a contract we’d signed with one of our clients. One such requirement was to provide penetration testing of our IT infrastructure and applications.

What were your goals for this project?

We set out to review the security of our new project by assessing external and internal IT infrastructure. This involved identifying existing security flaws and vulnerabilities, attempting to exploit those vulnerabilities, and demonstrating relevant security risks.

SOLUTION

How did you select this vendor?

We chose Berezha Security from among several companies. We also had some recommendations from acquaintances that work with IT Security. Our client also approved of them.

Describe the project in detail.

Berezha Security scanned our infrastructure and applications for three weeks. Throughout that time, they provided us with their current status and progress. Several weeks later, we received a detailed report with their recommendations. After implementing those recommendations, they did a final scan and delivered a final report.

What was the team composition?

Their team consisted of four members. We also were assigned a project manager to support us.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

By performing penetration tests, we significantly improved cooperation with our new client. We also reduced security risks for our whole company. I believe we're better protected now, seeing as many of their ideas were new to us.

How effective was the workflow between your team and theirs?

The collaboration was easy and effective.

What did you find most impressive about this company?

Their professional skills are really great.

Are there any areas for improvement?

Everything was fine.

BACKGROUND

Please describe your company and your position there.

I’m the cybersecurity manager at a software development firm.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We needed an independent party to perform our annual penetration test to comply with a specific information security standard (ISO 27001).

What were your goals for this project?

We had to assess our current protection level and identify potential network and application infrastructure weaknesses. We also needed to measure our staff’s awareness of information security topics.

SOLUTION

How did you select this vendor?

We chose from between three vendors. Berezha Security’s offered approach was the best match for our price and scope.

Describe the project in detail.

Initially, we laid out our scope, previous approaches, and preferred communication plan for the vendor. They worked through our agreed stages independently with minimal involvement from our employees. We received a detailed report of our weak points and Berezha Security’s recommended fixes.

What was the team composition?

We worked with a project manager and a couple of security analysts.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Their protection measures are effective.

How effective was the workflow between your team and theirs?

We were in constant communication via phone and instant messaging.

What did you find most impressive about this company?

I’ve worked with several vendors, but Berezha Security is distinguished by its quality approach to task fulfillment and perseverance.

Are there any areas for improvement?

No. We’re satisfied with the results.

BACKGROUND

Please describe your company and your position there.

I’m a co-founder and CTO of Cloverpop, Inc., a B2B SaaS startup headquartered in San Francisco. Our company has about 30 employees, and we serve enterprise companies. I oversee our software development operations.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We approached Berezha Security to conduct this year’s annual penetration test of our online applications to improve our security and comply with our security operations center (SOC) obligations.

What were your goals for this project?

We were already aware of a minor outstanding security issue but wanted to identify new ones that we weren’t yet aware of.

SOLUTION

How did you select this vendor?

We identified five potential vendors, including Berezha Security. One of our security engineers spoke with each vendor, and we asked for a written proposal. Ultimately, we selected Berezha Security based on a combination of industry reputation, professionalism, responses to our questions, processes described in the proposal, and the reasonable price range.

Describe the project in detail.

We outlined a timeframe for the penetration test and established a secure communication process to be followed if any significant breaches were detected by Berezha personnel. At the end of the test, they delivered a detailed written report of their findings, and the team provided advice/support on how to best deal with each vulnerability found.

What was the team composition?

We primarily communicated with a project manager, but there was also a lead security engineer who answered our technical questions about specific issues.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They discovered a medium-level security risk that we were unaware of and fixed it by the first day of the project. They also gave excellent advice on how to deal with the minor risks that we knew about but were unsure how to address without negatively impacting our customers. At the end of testing, they delivered an excellent written report that we could share with enterprise customers and SOC auditors.

How effective was the workflow between your team and theirs?

I was pleased with their responsiveness. I corresponded with their project manager who replied instantly to my inquiries, even during weekends and off-hours.

What did you find most impressive about this company?

I was impressed with their work processes, which they’d described during the bidding phase and followed diligently during the test. It was also clear that they cared about our long-term security and wanted to establish a lasting vendor relationship with us rather than just a single project.

Are there any areas for improvement?

No, nothing that I can think of.

BACKGROUND

Please describe your company and your position there.

I'm CTO of Quipu GmbH, an IT service provider for Procredit Group. I'm responsible for software development, implementation, and support.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We hired Berezha security to conduct a security analysis of the new version of a mobile application.

SOLUTION

How did you select this vendor?

Our IT security department chose them based on recommendations of their colleagues. We had collaborated with Berezha Security before on other projects.

Describe the project in detail.

Berezha Security performed penetration testing of a mobile app built on both Android and iOS platforms. We introduced them to our solution’s architecture and business logic, after which they conducted the necessary tests and then provided a report on the encountered vulnerabilities as well as recommendations on how to fix them. After we followed their suggestions, they confirmed that the issues could be considered closed.

What was the team composition?

We had a project manager involved from our side that communicated with Berezha Security’s COO. There were several other specialists involved in the process, though.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We’re satisfied with the results of the project. Berezha Security helped find mistakes in the design that could’ve led to possible hacker attacks. Their recommendations were deeply technical as well, which helped us organize our work and architectural design in a better way.

How effective was the workflow between your team and theirs?

All communication was done in a friendly manner.

What did you find most impressive about this company?

Our collaboration with Berezha Security was really valuable because it allowed us to not only cover the needs of this particular project but also learn new and important things to take into account for future developments.

BACKGROUND

Introduce your business and what you do there.

Our company provides a platform for temporary staffing agencies. I serve as the software architect.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Berezha Security?

We were looking for a company that could oversee our security and do penetration testing.

SOLUTION

What was the scope of their involvement?

They performed various security reviews and penetration tests for our platform’s infrastructure. Afterward, they provided reports detailing which components they checked and any salient results. We used their findings to improve our platform. The team also offered a free retest in the months following to see if we actually fixed the issue.

What is the team composition?

I’m not sure how many people were involved in the testing, but we had a single point of contact.

How did you come to work with Berezha Security?

One of our colleagues had worked with them before and referred us to them.

How much have you invested with them?

We spent less than $5,000.

What is the status of this engagement?

Their work lasted from May–June 2017.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

The penetration tests have helped us ensure that we have a well-protected software. We're now more confident in our product’s security.

How did Berezha Security perform from a project management standpoint?

They performed well. There were no delays in response time, and communication was good. We had a group chat with quite a few people. If we asked for extra reports or documentation, they always provided them.

What did you find most impressive about them?

They were high-level professionals with enough knowledge to advise us on our security measures. They provided us with good information to improve our platform.

Are there any areas they could improve?

No, nothing comes to mind. Working with them was good.