KiwiQA Services

BACKGROUND

Introduce your business and what you do there.

I’m the CEO of a company that develops virtual conference software for event management.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with KiwiQA Services?

We needed to test our systems.

SOLUTION

What was the scope of their involvement?

KiwiQA tests the security of our platforms, which includes iOS and Android apps as well as web platforms. Their team also does load testing for us. When they do the tests, they also make recommendations to improve our security.

Their team initially did a couple of tests for us. More recently, we hired them on an annual basis. Their team’s working on our system all the time and building testing platforms.

What is the team composition?

We’ve worked with probably three people. We spoke with the owner who put a senior teammate in charge of the project. We also communicate with the teammates who actually test the platforms.

How did you come to work with KiwiQA Services?

We have an office in India and through that office, we found KiwiQA. They also have an office in India.

How much have you invested with them?

The initial testing cost between $5,000–$10,000.

What is the status of this engagement?

We initially engaged them in 2018 and our partnership’s ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

We’re happy with the results of their tests. Their team does a good job. We look at our servers and see people trying to enter our systems from all over the world, but we’ve never been hacked. We follow their guidelines and it seems to work.

KiwiQA makes a lot of recommendations. They’ve recommended a lot that we can’t change because of the way our system runs. Their team comes up with advisories too, rather than only compulsory suggestions.

How did KiwiQA Services perform from a project management standpoint?

Most of the time our developers communicate with KiwiQA about the intricate parts of our system. I speak to them about what we need. They’re very good from a project management standpoint. They work with us well and work within our budget, which is good.

What did you find most impressive about them?

KiwiQA’s doing well given their expansion over the last few years. They’re building a good quality business. We just signed up with them again, so they’re getting repeat business. I haven’t seen bad reviews for them anywhere.

Are there any areas they could improve?

No, not really.

Do you have any advice for potential customers?

To start, speak to one of the owners. Tell them exactly what you want. They’ll understand your needs.

BACKGROUND

Please describe your company and your position there.

I am CEO of All In The Loop Inc. Our company provides mobile apps for events, conferences, meetings and trade shows

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire KiwiQA Services?

Security VAPT Testing for both Web and Mobile handsets.

What were your goals for this project?

We were looking for security flaws in our platform and to find if we had any major vulnerabilities which could cause serious damage to data as well as our product.

SOLUTION

How did you select this vendor?

We spoke to various companies and researched them on the internet. We also had a face to face meeting with these guys and some others so we could see how they worked and what their setup was like. Out of all the companies we checked on line, spoke with and met I felt most comfortable with these guys. They took the time to explain in detail exactly what needed to be done and how it was achieved.

Describe the project in detail.

We described in detail how our system works and went through a couple of apps with them. The then dealt with our developers to understand correctly the flow and how they should test the system.

What was the team composition?

Initial Meetings were with the director of the company Then we were given a project manager who clearly had years of experience in security. We didn't deal directly the testers as this was ll managed by the project manager

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

This is a list of what was discussed, tested and of what they delivered results for.

FOCUS & OBJECTIVE TERMINOLOGY AND SCORE INFORMATION GATHERING

Application Summary Test Environment Port Scan Manifest Analysis

• Activities:
• Permissions
• Broadcast Receivers
• Services
• Content Providers

APPLICATION VULNERABILITIES 

Vulnerability Summary

VULNERABILITY DETAIL AND MITIGATION 

1. Vulnerability #1: Improper Input Validation-Blind SQL Injection
2. Vulnerability #2: Insecure Direct Object Reference
3. Vulnerability #3: Directory Listing
4. Vulnerability #4: Logging Sensitive Data
5. Vulnerability #5: Lack of Binary Protection
6. Vulnerability #6: Android Backup Vulnerability
7. Vulnerability #7: Clear text insecure data storage in Shared preferences
8. Vulnerability #8: Weak Password Policy
9. Vulnerability #9: Clear Text Password submission
10. Vulnerability #10: E-mail Bombing and Spamming
11. Vulnerability #11: Certificate Pinning not enforced
12. Vulnerability #12: No Root Detection
13. Vulnerability #13: Tapjacking
14. Vulnerability #14: Web view Vulnerability
15. Vulnerability #15: Secure Flag not set
16. Vulnerability #16: Path disclosure

How effective was the workflow between your team and theirs?

We had no complaints regarding the workflow. The project manager gained a full understanding of our system and the flow before allowing the testers to start their work so he could guide them co very everything that was required.

What did you find most impressive about this company?

They delivered exactly what was promised, which was a full security report for our system. They found a few small issues and had some recommendations for improvement. They didn't just send us the report they advised us how to implement the changes they had suggested

Are there any areas for improvement?

I am not in the security business so not sure how I could suggest improvements to the way they do their business. We will be using them again very soon as our system is now much larger than it was a year ago

BACKGROUND

Please describe your company and your position there.

I'm the QA team lead at Gameforge. We provide free-to-play massively multiplayer online games (MMOs) and host 20 titles for over 450 million registered players.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire KiwiQA Services?

We used KiwiQA Services to audit the security of one of our web platforms.

What were your goals for this project?

We wanted to find potential security vulnerabilities.

SOLUTION

How did you select this vendor?

I did an online search. I saw KiwiQA Services’ web page, and their offerings looked great. They provided us a proof of concept, and we hired their team for the project.
 
Describe the project in detail.

KiwiQA Services found issues in our platform during the security audit. The team then gave us a risk assessment and suggested ways to fix the problems. 

What was the team composition?

I can’t share how many were on the team.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

It was a very good cooperation. Thanks to KiwiQA Services’ excellent reporting and risk assessment, we were able to fix existing vulnerabilities effectively. I’m happy with the quality of their evaluation. 

How effective was the workflow between your team and theirs?

The communication was good. KiwiQA Services made themselves available on several tools. They were responsive, flexible, and willing to give suggestions.  We received a daily report with a short review of the project—including what they found and have completed. We later got a final report of the project’s status.

What did you find most impressive about this company?

KiwiQA Services was flexible in changing the roadmap or schedule as needed. 

Are there any areas for improvement?

I can’t think anything for them to improve right now. 

BACKGROUND

Please describe your company and your position there.

Wholesale Helper is a family of Shopify Apps focused on helping merchants sell wholesale on Shopify. I am the CEO

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire KiwiQA Services?

We are developing an API and consulted with KiwiQA to help us do performance testing and security testing.

SOLUTION

How did you select KiwiQA Services and what were the deciding factors?

Based on reputation, initial call, process on how they run tests.

Describe the project in detail and walk through the stages of the project.

We are developing an API and consulted with KiwiQA to help us do performance testing and security testing.

How many resources from the KiwiQA Services team worked with you, and what were their positions?

2

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The API performed well with the load testing. For security testing, they made 1 suggestion, so overall very good.

How effective was the workflow between your team and theirs?

They were great communicators and moved fast.

What did you find most impressive or unique about this company?

They were communicative, hardworking, and effective.

Are there any areas for improvement or something they could have done differently?

Maybe reduce the price a bit. It wasn't crazy expensive but could be a bit cheaper.

BACKGROUND

Please describe your company and your position there.

I’m the head of QA at CyberIt AS, a Norwegian technology firm.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire KiwiQA Services?

We hired KiwiQA Services to help us with testing and test automation.

What were your goals for this project?

We wanted to implement an effective and robust test automation process.

SOLUTION

How did you select this vendor?

We chose KiwiQA Services after seeing some of their excellent work samples.

Describe the project in detail.

KiwiQA Services held several initial meetings to understand our requirements. They eventually came up with a sophisticated solution that meets our needs.

What was the team composition?

They've assigned us a project manager and about five specialists.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We’ve been able to establish a new testing process, despite having started the partnership less than a month ago.

How effective was the workflow between your team and theirs?

They’ve been collaborative and communicative.

What did you find most impressive about this company?

They’re a highly skilled group of people, and they deliver everything on time.

Are there any areas for improvement?

I can’t think of any at this time.