Active audit agency, LLC

BACKGROUND

Please describe your company and your position there.

I'm one of the co-founders of Mereo, a Brazilian HRTech supporting companies from a broad range of segments with Performance Appraisal, feedback, 9box, etc processes.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Active audit agency, LLC?

Annual cybersecurity check of our scenario, including our processes and products.

SOLUTION

How did you select this vendor and what were the deciding factors?

Actually, we were found by Active Audit Agency a couple of months ago, when they found and disclosed to us (white hat approach) a potential vulnerability of one of our code analysis tools. We appreciated the approach and understood they could be our partners for our next annual security check.

Describe the project in detail and walk through the stages of the project.

Different tests were performing, including, but not limiting to: External intrusion to our platform. Internal intrusion to our platform (users with access already granted). Social engineering threats check Everything that was part of the previously agreed scope was performed. Follow-up meetings were held periodically. Any critical discovery was promptly informed and double checked upon resolution. At the end, a comprehensive report was submitted to us, with the discoveries and lines of action about what should be done.

How many resources from the vendor's team worked with you, and what were their positions?

1 penetration tester, 1 project manager, 2 security analysts.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

In one of the tests that we previously agreed upon, we discovered that, due to increased people turnover in the past few months, we would have urgently to revise our cybersecurity training to employees in order to avoid phishing attacks. That was executed by us and the process behind it was also revised to avoid any lags due to eventual next people turnovers.

How effective was the workflow between your team and theirs?

AAA team was always very professional regarding the follow-up and reporting. We used Zoom platform for our meetings. As a matter of fact, the few meetings that went out of schedule were due to bad planning on our side. Even so, AAA team were able to reschedule it and re-acommodate the meetings when needed.

What did you find most impressive or unique about this company?

Their technical skills and professionalism in presenting the issues ad possible ways to fix them were impressive. Also, the flexibility regarding the time.

Are there any areas for improvement or something they could have done differently?

None.

BACKGROUND

Introduce your business and what you do there.

I’m the chief information security officer at Skywell Software.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Active Audit Agency?

As a company certified according to ISO standards, we have requirements for independent annual penetration testing of our network and servers. Even if we think that our network is secure, new vulnerabilities appear every day, and there are hackers exploiting them. 

There’s a constant need to check for those vulnerabilities, and we can’t do this ourselves because of budget constraints. We could use open-source software, but that’s not very sophisticated in finding vulnerabilities. It was better to hire someone trained in that area, who could do it professionally.

SOLUTION

What was the scope of their involvement?

Active Audit conducted a penetration test with the aim of finding vulnerabilities in our network. They first tried to break into our on-site datacenter, pretending to be a hacker that doesn’t know anything about our infrastructure. They were simply given the IP address of our server. 

The second stage involved Active Audit having access to our inner network. They impersonated an employee that had bad intentions. They ran network scanners and other programs from PCs in order to see which areas of the network a regular employee could gain access to (i.e., not an administrator). 

After that, they provided several technical reports on outer and inner scans and website scans. Active Audit produced a final report containing an analysis of all vulnerabilities. They provided a description, risk assessment, recommendations for each vulnerability. Inner vulnerabilities that would’ve otherwise been critical were marked as medium because they were not exploitable from the outer network. 

They made security scans using different software and generated reports from those, and they explained how we could implement their recommendations on both Windows and Linux systems. We’re currently working on fixing the vulnerabilities that were found.

How did you come to work with Active Audit Agency?

We’d previously worked with them on a project unrelated to penetration testing but was related to security consulting. It involved a lot of work with policy development and security awareness training and we came to know Active Audit really well. We were pleased with their work so we contacted them again to see if they’d provide penetration testing services and negotiated. 

We got in touch with 4–5 companies for commercial propositions, and Active Audit’s rate was somewhere in the middle. They did give us a discount because we were an existing client, and we chose them for the project. 

How much have you invested with them?

The project cost was about $5,000. They gave us a discount because of our previous engagement and because of the hard times brought by COVID-19. We also tried to keep the scope as small as possible to address only the server-side and website. 

What is the status of this engagement?

We put together the requirements in late July 2020, and the active testing started at the beginning of August 2020. We received the final report a few weeks later and then just took care of the financial matters.  

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Active Audit gave us comprehensive answers on why they chose to define the vulnerabilities the way they did, and how they would affect our network. Active Audit went beyond just giving us some reports, and they always gave us advice when we asked for it.

How did Active Audit Agency perform from a project management standpoint?

We agreed on the scope of the scans at the start of the project. There was an issue near our site which caused a local blackout. It took us a bit of time to figure everything out, but Active Audit helped us work through it by building new VPN channels to connect through and keep our timeline.  

What did you find most impressive about them?

We’re totally satisfied with how they worked, their final report, and their attitude toward what they do. They were always available, including after their working hours. They worked with us almost until midnight when we were switching internet providers, consulting us on how to connect VPN channels so that we wouldn’t lose too much time the next day.

Are there any areas they could improve?

They should continue to look at where the market is going and what clients want, and try to be on that level.

Do you have any advice for future clients of theirs?

I would definitely recommend Active Audit for penetration testing.

BACKGROUND

Please describe your company and your position there.

Information security officer Company name: NDA

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Active audit agency, LLC?

Penetration testing and preparation for PCI DSS certification.

What were your goals for this project?

Goals for this project: Prepares for PCI DSS certification; Arrangement of the revealed discrepancies; Improvement of ISMS; Identification of vulnerabilities in IT system.

SOLUTION

How did you select Active audit agency, LLC?

Previously, we have already worked with Active audit agency, LLC.

Describe the project in detail.

Active audit agency, LLC was hired to execute penetration testing to IT system. They ran efforts to test the security and provided technical reports, and provided their professional recommendations. Active audit agency, LLC also prepared the company for further PCI DSS certification

What was the team composition?

Active audit agency, LLC testers with support of local IT members.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

this is confidential information.

How effective was the workflow between your team and theirs?

Very effective and cooperative.

What did you find most impressive about this company?

Professional and customer oriented team members.

Are there any areas for improvement?

none

BACKGROUND

Please describe your company and your position there.

I'm CIO in subsidiary of well known international financial institution.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Active audit agency, LLC?

Active audit agency, LLC executed penetration test for our local core banking system.

What were your goals for this project?

To reveal application and underlying infrastructure weaknesses.

SOLUTION

How did you select Active audit agency, LLC?

Active audit agency, LLC won a competition (tender) for executing penetration test project.

Describe the project in detail.

Penetration test for local core banking application and underlying infrastructure.

What was the team composition?

Active audit agency, LLC testers with support of local IT members.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Project fully met expectations, detailed report was provided, showing results and possible weaknesses, including recommendations for remediation.

How effective was the workflow between your team and theirs?

Very effective and cooperative.

What did you find most impressive about this company?

Professional and customer oriented team members. Always deliver on promises.

Are there any areas for improvement?

We were very happy about the speed and quality of the services provided.