Biz Serve IT

BACKGROUND

Please describe your company and position.

I am the Chief Product Officer of Myra ERP (Neosys Technology Private Limited)

Describe what your company does in a single sentence.

Myra Erp is a neo banking solution for financial cooperatives and other financial instutions.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Biz Serve IT to accomplish?

• Improve infromation security posture
• Data security
• Compliance

SOLUTION

How did you find Biz Serve IT?

Referral

Why did you select Biz Serve IT over others?

• Pricing fit our budget
• Referred to me

How many teammates from Biz Serve IT were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

1. Quarterly security testing (vulnerability assessment and penetration testing) of our network and applications (web and mobile).
2. Information security program development and maintenance. 
3. ISO 27001: 2013 implementation and certification.
4. Upgrade to ISO 27001: 2022.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

1. Create a vulnerability free infrastructure with identification and clousure of any identified issues.
2. Information security program development.
3. ISO 27001 certification within agreeded upon timeframe.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

They assign a project manager who tracks the project from kick-off to closure, so any request by us goes through the PM making the process efficient. 

We are happy with their delivery time, therefore we have a continuous engagement with them.

What was your primary form of communication with Biz Serve IT?

• In-Person Meeting
• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

They have a good technical capacity with background in the Banking and financial industry. Biz Serve IT has been impressively cost-effective. Also considering the cost factor I believe not your tech team but also your management will be more than happy with their services.

Are there any areas for improvement or something Biz Serve IT could have done differently?

Though their report contains everything needed it can still be improved. 

BACKGROUND

Please describe your company and your position there.

As a business manager at a Gokyo Labs (data science company), I am responsible for overseeing the day-to-day operations of the company and ensuring that it is meeting its goals and objectives. This can include managing a team of data scientists and other employees, creating and implementing business strategies related to data science, and data matching and working with clients to understand their data needs and develop solutions to meet those needs. In order to be successful in my role, I have a strong understanding of data science and the various tools and techniques used in the field, as well as excellent leadership and communication skills. I also think strategically and make sound decisions that align with the company's goals and objectives.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Biz Serve IT?

Our need to affiliate with Biz Serve IT was to conduct Continuous VAPT, Threat Modeling & SAST and help us to streamline our DevSecOps process.

SOLUTION

How did you select this vendor and what were the deciding factors?

Our choice of cyber security partner was Biz Serve due to two factors: 1. Cost Benefit Value 2. 360 Degree coverage for DevOpsSec processes, from threat modeling, SAST and VAPT.

Describe the project in detail and walk through the stages of the project.

For Web Application VAPT: Initially, they also tested our application using the black-box method. They looked for open vulnerabilities taking reference from the OWASP Top 10 testing framework, which requires user-level access to the system. The tests covered all the API endpoints on the webserver. They used Burp Suite Professional, and their internal scripts. For Infrastructure VAPT: In this process, our main objective is to discover security gaps in our infrastructure. So, they tested our infra as an attacker, taking reference from penetration testing standards. They used Nessus Professional, Burp Suite Professional and internal scripts during the process. For Threat Modeling: They performed threat modeling using the STRIDE framework. For SAST/Code Review: Their team helped us with code review to discover security vulnerability in our code base. They also used semgrep during the process. All of these processes are continuous and our engagement with them is on quarterly basis.

How many resources from the vendor's team worked with you, and what were their positions?

We had a project manager, two technical leads, and two other team members for each project.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Working with Biz Serve IT, we recognized two major successful outcomes: 1. We were able to identify risks in our infrastructure and application and address them correctly. 2. As they have been helping us from the requirement, design and development phase, the overall cost of discovery of vulnerabilities before deployment and in production has reduced.

How effective was the workflow between your team and theirs?

Biz Serve IT maintained a constant communication flow with our team. For SAST and Threat modeling they were already working with our team while for VAPT, they immediately flagged and reported us about any critical issue. They had weekly updates, at the end of the project they submitted us a compiled report.

What did you find most impressive or unique about this company?

Biz Serve IT has a very competitive pricing in comparison to other vendors for the services we purchased.

Are there any areas for improvement or something they could have done differently?

We could not identify any areas of improvement, yet during pre project engagement for activities like planning and scoping, we felt they took time more than we expected. However, this eventually led to better estimations and scheduling.

BACKGROUND

Please describe your company and position.

I am the Chief Business Development Officer of Tigg App

Describe what your company does in a single sentence.

We are a software as a service accounting platform.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Biz Serve IT to accomplish?

• Improve overall security of our product (Tigg App).

SOLUTION

How did you find Biz Serve IT?

Referral

Why did you select Biz Serve IT over others?

• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Referred to me

How many teammates from Biz Serve IT were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

1. Annual auditing and Quarterly VAPT of our application and network/infrastructure 
2. Security Incident Investigation
3. Security Program development and ISO 27001 certification

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

1. Identification of vulnerabilities and exploits
2. Incident investigation and remediation support
3. ISO 27001 certification (2013 first and now 2022)

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Yes, they did

What was your primary form of communication with Biz Serve IT?

• In-Person Meeting
• Email or Messaging App
• Virtual Meeting

What did you find most impressive or unique about this company?

Biz Serve IT has a good and friendly technical team. We highly recommend Biz Serve IT based on our experience. They showed exceptional expertise in:

• VAPT
• Incident investigation
• Auditing
• Security program development. 

They also guided us through obtaining ISO 27001 certification, which is very important for us strategically.

Are there any areas for improvement or something Biz Serve IT could have done differently?

Time management can be improved, for the first engagement it took slightly long time for incident investigation.