Pakurity

BACKGROUND

Please describe your company and your position there.

I am the CEO at WebSupergoo. WebSupergoo produces cutting edge components for Windows. It is an established company with thousands of clients. Our Enterprise Level clients include companies like Microsoft and Hewlett-Packard. We specialize in imaging and internet technologies and provide innovative, industrial quality solutions. The number of organizations licensing products such as ABCpdf run into many tens of thousands.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Pakurity?

We were looking for an in depth third party penetration test for our ABCpdf software component. We produce software for software developers - the things they find too difficult to do themselves - so we are pretty high end. We needed a similarly high end penetration testing organization.

SOLUTION

How did you select this vendor and what were the deciding factors?

We evaluated a number of differnet contractors and companies and Pakurity really jumped out as being the most solid. They were not the cheapest but they certainly were very much more technical than the others. We like technical.

Describe the project in detail and walk through the stages of the project.

Our customers demand a high level of assurance about software components that they use in their critical applications. They need them secure and reliable. Pakurity performed an application security audit for ABCpdf. It was conducted in graybox manner without access to the source code.

How many resources from the vendor's team worked with you, and what were their positions?

Pakurity provided a small team of about four or five people working on various aspects of the project. Small but elite. The special forces of code.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Pakruity provided us with valuable recommendations relating to security. As we had expected, they did not find any major problems, but they certainly did some very interesting things which will feed back into future developments. They beat the software to within an inch of its life and it survived. That is exactly what they were employed to do and they did an outstanding job.

How effective was the workflow between your team and theirs?

The prjoject took place over a period of three or four weeks with feedback being provided at regular intervales. The continual feedback allowed us to steer them into productive areas of interest.

What did you find most impressive or unique about this company?

The sheer technical excellence of the team is remarkable. We deal with developers all over the world on a day to day basis. There are few who match up to their standards. Really they are the top 1% and that's probably understating it.

Are there any areas for improvement or something they could have done differently?

With something so close to perfect it would be churlish to find fault.

BACKGROUND

Please describe your company and your position there.

I am an Enterprise Solutions Architect and Founder of Immersive Authority, who have developed a Fintech app

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Pakurity?

Penetration testing of an app (cross-platform, iOS and Android), backend on AWS. Source code audit and vulnerability assessment against OWASP standards for mobile apps, and more.

What were your goals for this project?

To ensure that all risks of data breach are identified where a illegal user can gain unauthorized access to data are identified, and recommendations on how to reproduce threats and mitigate against it are documented.

SOLUTION

How did you select Pakurity?

The first step was to be clear on what we wanted to achieve from this exercise before even reaching out. There are many people who claim to be security specialists who only know how to run basic pentesting,. SAST or DAST tools on an application (code, project build or against the api). We needed a team with domain experience, code experience and security credentials + test experience who could cover our needs, which we got from Pakurity

Describe the project in detail.

We have an app that allows users to capture secret records, encrypts records and stored it on the cloud and decrypts it to certain parties under conditions that the user specifies. Before we could go to market, we needed an independent cybersecurity firm to test the security controls, audit the app and see if they could gain access to a user's encrypted record. The scope also included identifying any potential threats, with recommendations for us to mitigate them.

What was the team composition?

We were assigned a project manager (who handled the project plan, delivery and communications) and 3 cybersecurity specialists. A multidisciplinary team with ethical hacking skills, OWASP experience and other related certifications.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We launched within 1 month of the final test report, after addressing the potential vulnerabilities identified by the Pakurity team. We were able to do so because Pakurity sent us weekly reports on their findings, which allowed our development team to address it, and ask any questions during the project

How effective was the workflow between your team and theirs?

Communication was great. The engagement was very professional and at all times we understood what was expected of each party.

What did you find most impressive about this company?

Professionalism, thoroughness in their investigation, honesty and integrity on their engagement, great experience/skill in working with the technologies in scope (mobile app and cloud), amount of detail in their report which was self-explanatory and easy to follow by our development team.

Are there any areas for improvement?

No. We are impressed with what we received

BACKGROUND

Please describe your company and your position there.

I am the CEO of a comparison service. The company was founded in 2015.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Pakurity?

We hired Pakurity to help us backtrace APIs which we were struggling to leverage. We needed their expert help.

What were your goals for this project?

The overall goal for the project was to find a way to efficiently extract the data we wanted from these private APIs. We wanted to make sure any solution would be long lasting.

SOLUTION

How did you select Pakurity?

We initially found Pakurity on Upwork. They stood head and shoulders over anyone else we were considering hiring.

Describe the project in detail.

We needed Pakurity to find a way to extract data from a source via backtracking the source's APIs. The project was time-sensitive and they delivered.

What was the team composition?

I dealt with three people. Vlad, Glib, and Victoria.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Their contribution helped us get the business-critical information we needed. We're very happy with the end result.

How effective was the workflow between your team and theirs?

Once we started the project, everything went pretty smoothly. Glib and his team didn't need to ask many further questions and were very professional.

What did you find most impressive about this company?

They are very organised. This was evident in the way they worked on the project, and especially in the quality of the end report. I am also impressed by how they have been willing to help us months after the work finished.

Are there any areas for improvement?

Nothing that I can think of. Pakurity provides top quality work and is very popular. Because of this be you must arrange projects well in advance.

BACKGROUND

Introduce your business and what you do there.

I’m the executive director and founder of an education technology software provider based in Australia. We work with Australian and international schools. 

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Pakurity?

We have contracts with state governments, so we needed a company to run a security audit that was in alignment with international standards that were prescribed by our clients.

SOLUTION

What was the scope of their involvement?

We gave them access to our platform, and they spent a few weeks running tests on our access and data storage. Then they identified any security holes they found in our system. That came in the form of a detailed written document that outlined all of the findings separately. It included mandatory fixes as well as recommended ones. After they ran the security audit, they worked with our development team to patch up security issues and provide accreditation to showcase that we identified the standards.  

What is the team composition?

I had one main point of contact, but all of their work was signed off by an executive. 

How did you come to work with Pakurity?

I found them on Upwork originally. After working with them for a while, we moved our collaborations off that platform. 

How much have you invested with them?

We’ve spent about $3,000 with them to date. 

What is the status of this engagement?

Every 18 months, we need to get accredited. This is the second time we’ve worked with them in this capacity. While their end of the work takes about a month, we’ve been engaged with them since December 2018. We plan on continuing to use their services in the future.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

They’re very professional, always providing us with a quality service and excellent communication.

How did Pakurity perform from a project management standpoint?

They were very proactive with their tasks and updated us regularly. Their team kept everything on track, so I recommend them without hesitation. Many of those who have taken my recommendations had similar positive experiences as well. 

What did you find most impressive about them?

Their general level of professionalism really stood out. Our past provider cost more but offered us less clarity in communication. Their team is clear and always gives their rationale when marking recommendations. 

Are there any areas they could improve?

I can’t think of anything.

Do you have any advice for potential customers?

I’d hire them— they offer good value for money and a quality job.

BACKGROUND

Please describe your company and your position there.

We are a Information security and compliance company. We conduct IT audits, certifications under PCI DSS and ISO27001 and provide consultancy on Information Security.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Pakurity?

As part of compliance obligations our clients need to perform Secure coding training and Penetration testing. We hired Pakurity, specifically Glib Paharenko, to perform onsite training to our client as well as the penetration test and provide a report.

What were your goals for this project?

- Penetration test in accordance with PCI DSS requirements 11.2. - Secure Coding training to a team of developers.

SOLUTION

How did you select this vendor?

We have known Glib for some time and have used him for other projects in the past. We are aware of his knowledge and experience.

Describe the project in detail.

Training had to be delivered onsite to a client based in Malta. It was scheduled in 2 sessions for all developers and IT people within the company. Training was organised in a workshop format. The penetration test followed PCI DSS requirements and involved External testing, internal testing as well as application type of testing.

What was the team composition?

The project was delivered by Glib Paharenko himself.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We are qualified security assessors so the project had to be acceptable to us based on PCI DSS requirements and standards. We were happy with the scope and methodology adopted. The report of the pentest was reviewed and showed professionalism. The training was considered a success by the client (end user)

How effective was the workflow between your team and theirs?

Once project scope was communicated, there was little communication required. No issues identified.

What did you find most impressive about this company?

Knowing that they have the experience to do the job gives us comfort that it is going to meet our requirements and to the standard required by PCI DSS.

Are there any areas for improvement?

At the time of the project the team was small but I think that issue has now been resolved.