Iterasec

BACKGROUND

Please describe your company and your position there.

I am the HR Manager of a FinTech startup with mobile and web app.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

We were looking for an external cybersecurity company to conduct an application-level pen test and infrastructure (cloud/container) security audit of our platform.

SOLUTION

How did you select this vendor and what were the deciding factors?

Iterasec was highly recommended by our offshore engineering team. Their expertise and pricing were key decision factors.

Describe the project in detail and walk through the stages of the project.

The pen test was performed by utilizing manual analysis and exploitation, along with automated tools where efficient/applicable. The cloud security audit was performed as a combination of the white-box assessment of the infrastructure, some dynamic security tests and interviewing our engineering team. At the end of the project, a detailed security gap report based on manual penetration testing was provided, indicating the influence and risks for our company and providing recommendations on how to fix all discovered security bugs.

How many resources from the vendor's team worked with you, and what were their positions?

Our main contact was Iterasec's CEO but he had a one or two team members working on our project.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Iterasec was able to identify some critical security issues that needed to be addressed immediately.

How effective was the workflow between your team and theirs?

Iterasec provided weekly progress reports, and were in constant communication with us for questions and updates.

What did you find most impressive or unique about this company?

Really appreciated the open communication about the different testing. They always followed up to see if we needed clarification about the reports.

Are there any areas for improvement or something they could have done differently?

None at all.

BACKGROUND

Please describe your company and your position there.

A full-stack development agency with a focus on mobile development. My position is CEO

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

We were hired by a governmental institution (under NDA) to perform a pentest of the third-party provider application they were going to use. 5Pro Mobile hired Iterasec as a subcontractor to perform a pentest

SOLUTION

How did you select this vendor and what were the deciding factors?

Iterasec were consulting us earlier on some projects regarding security. The reasons for vendor selection were:

• High quality of the consulting work performed earlier
• Approach of Iterasec is very structured, clear and effective. Expectations were very clearly described, the process was very transparent and understandable for client.
• Iterasec has senior specialists which makes the direct contact with the client very pleasant and professional;
• Deliverables (report) was clear and detailed.

Describe the project in detail and walk through the stages of the project.

Iterasec performed a pentest of the web application that collects quite some sensitive information about the employees. The steps in the process were:

1. Collect necessary input information per email.
2. Kick-off call to clarify open questions and explain the next steps;
3. Pentest of 5 weeks. We received a status update report each week. In case of high-impact vulnerabilities, the extra report was sent immediately (so that the client could fix it asap).
4. Final report was provided at the end and the client was given a possibility to plan a call to discuss it.
5. Our client had 3 months time period to fix the findings. After the findings were fixed, Iterasec checked whether it was done in a proper way. In the meantime, Iterasec answered all the questions they received from the client regarding the possible ways of fixing the vulnerabilities

How many resources from the vendor's team worked with you, and what were their positions?

I had one contact person (Ihor). He is CEO and security expert himself.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They found critical vulnerabilities that were unexpected for the client.

How effective was the workflow between your team and theirs?

Very effective. Iterasec had well-established processes and reacted very fast.

What did you find most impressive or unique about this company?

Very high quality of work and seniority of the employees. Very professional approach.

Are there any areas for improvement or something they could have done differently?

No.

BACKGROUND

Please describe your company and your position there.

We develop products and services, provides consultancy and support for various clients and partners. Among them, there are both dynamic small to medium businesses in FinTech, Edtech, AgroTech, etc, and startups from YCombinator & TechStars on Series A to D funding rounds. Our team has completed more than 100 projects on time and budget in different domains, including: finance, retail, automotive, real estate, transportation, education, tourism. We were working with businesses from the USA, UK, Germany, Switzerland, Japan, Singapore, Ukraine.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

Iterasec consulted in quality management system (QMS) and information security management system (ISMS), shared knowledge to build documentation base and help with planing of related activities. Also Iterasec consulted us in a lot of questions related to information security and quality management.

SOLUTION

How did you select this vendor and what were the deciding factors?

We search online several companies and we didn't find good enough company this way. Later Iterasec CEO connected with our CEO via LinkedIn and we found Iterasec to be right partner.

Describe the project in detail and walk through the stages of the project.

It was used Plan-Do-Check-Act approach to our project what is well known strategy in Management System implementation. During Plan stage we made detailed plan of the activities for the year. During Do stage we developed documentation adopted to the company processes and identified changes that were required to be compliant with standards. We had several additional planning and successfully implemented systems. During Check phase Iterasec conducted inter audit and identified issues in our processes. In the Act phase we fixed those issues and submitted to certification process.

How many resources from the vendor's team worked with you, and what were their positions?

We had 2 persons assigned, both of them are experts in this topic and great persons. Collaboration brings very good results and great experience.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We successfully passed ISO9001 and ISO27001 external audits with Bureau Veritas, so all that work had great results!

How effective was the workflow between your team and theirs?

We used part-time allocation, which allowed us to implement new systems without corrupting existing activities. In my opinion it is most effective approach.

What did you find most impressive or unique about this company?

Personal connection matter, we had great experience and understanding of the common sense, I believe it is really unique.

Are there any areas for improvement or something they could have done differently?

Hope Iterasec will work with a lot more amount of companies to help them with security questions cause this company really knows everything about it.

BACKGROUND

Please describe your company and your position there.

I'm CTO at Open Social, a top-tier SaaS company. Open Social is specialized in online community and membership management solutions.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

We wanted to get ISO 27001 certified. Iterasec helped us to plan, prepare and act to create a fully functioning Information Security Management System and be ready for an external audit.

SOLUTION

How did you select this vendor and what were the deciding factors?

We've been looking at a good consulting party. One of our trusted partners worked with Iterasec and was very happy with them. After one or two talks we decided to go with Iterasec as they appeared to be knowledgeable and professional.

Describe the project in detail and walk through the stages of the project.

The prepared with us the plan to get certified, including timelines, milestones, etc. Every week we were doing status update meetings, they would review the work we did and help us with good examples. Additionally they helped us with asking the necessary questions to get us to understand how certain items would match with our specific company structure and culture. Iterasec also performed the internal audit in which they raised several issues that we fixed together. They also prepared and gave security workshops for our engineers and we're planning a pentest with them to be done in the coming weeks.

How many resources from the vendor's team worked with you, and what were their positions?

The CEO was our main point of contact, but was supported by someone that was trained as an auditor.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We've recently had an accredited auditor assess our ISMS during the external audit. Improvements were raised, but no nonconformities were discovered. For us this was a huge success and showed Iterasec's expertise as they already found all our issues in the internal audit.

How effective was the workflow between your team and theirs?

The communication was quick and professional. We had status update meetings weekly, where necessary twice a week. They were in our Slack channel, which also gave the feeling they were part of our team.

What did you find most impressive or unique about this company?

They are easy to approach, knowledgeable, and strive to deliver quality solutions. I personally learned a lot from Iterasec and I've really enjoyed working together.

Are there any areas for improvement or something they could have done differently?

None that I can think of. We've worked closely together over the last 9 months and it's been a smooth ride.

BACKGROUND

Please describe your company and your position there.

I'm the co-owner and CTO in the software development company building digital products for media and public sector

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

We were looking for an external cybersecurity company to perform the audit of our SaaS products codebase and infrastructure, to ensure that we don't have critical issues.

SOLUTION

How did you select this vendor and what were the deciding factors?

Vendor has conducted security workshops on OWASP and secure SDLC for Innocode in the past, we have provided vendor with requirements and specifications and received qualified offer.

Describe the project in detail and walk through the stages of the project.

Innocode has initiated two security testing projects to verify the security of the Innocode product platform, both from the application and infrastructure points of view. The first project, application pentest, has been performed in a grey-box way, i.e. with available documentation access without source code.

The second project, cloud and container security audit, has been performed in a white-box way, i.e. had full access to the Platform's GCP infrastructure in a viewer mode. The main project deliveries were two reports with a detailed list of security findings discovered and recommendations on how to remedy such threats.

Both reports also provide high-level recommendations and strategic areas for security improvements. They performed the security audit for all our SaaS web and mobile products, by the following guidelines and standards:

• OWASP Application Security Verification Standard

• OWASP Mobile Security Verification Standard

• OWASP Web Security Testing Guide

• OWASP Mobile Security Testing Guide Stackdriver Monitoring

• OWASP Risk rating methodology

• Common Vulnerability Scoring System v 3.0

• OWASP Top 10 Privacy Risks

• OWASP Top 10 2017

• OWASP Top 10 2021

• OWASP API Security Top 10 2019

• Center for Internet Security (CIS) Google Cloud Platform Foundation Benchmark version 1.1.0

• Center for Internet Security (CIS) Google Kubernetes Engine (GKE) Benchmark version 1.1.0

• Google Cloud Security Foundations Guide (April 2021)

• USA's National Security Agency (NSA) Kubernetes Hardening Guidance (August 2021)

As for the infrastructure: The following tools were used as well as manual checks processed using Google Cloud Console/Cloud Shell:

• GCP CIS 1.1.0 Benchmark Inspec Profile

• GKE CIS 1.1.0 Benchmark Inspec Profile

• kube-bench

• Kubescape

• GitLab Red Team GCP audit tools

How many resources from the vendor's team worked with you, and what were their positions?

We had an Iterasec SEO and 2 security engineers

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They were able to identify far more risks comparing to our internal routines, and also pointed out few configuration flaws on the tools that we use. Also they have provided us with 2 workshops on threat modelling and secure SDLC

How effective was the workflow between your team and theirs?

They kept us updated all the time, we received reports in time.

What did you find most impressive or unique about this company?

We appreciated that they provided a high level of suggestions and audit, which was what we needed at this stage.

Are there any areas for improvement or something they could have done differently?

All is good

BACKGROUND

Please describe your company and your position there.

I am IT Lead in an IT Out-stuffing company.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

To perform an annual penetration test.

SOLUTION

How did you select Iterasec and what were the deciding factors?

We searched for cybersecurity companies and after having several calls, we chose Iterasec based on their experience and service package.

Describe the project in detail and walk through the stages of the project.

They performed a penetration tests of our infrastructure (several locations) as well as our web, mail and VoIP servers. After the tests they delivered detailed report and provided a list of recommendations.

How many resources from the Iterasec team worked with you, and what were their positions?

We had a project manager, security analyst and a penetration tester.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Iterasec identified more risks than our internal tests did. Provided recommendations were detailed and helpful.

How effective was the workflow between your team and theirs?

They kept us updated all the time. Reports are easy to understand.

What did you find most impressive or unique about this company?

Their easy communication and responsiveness during the tests were impressive.

Are there any areas for improvement or something they could have done differently?

N/A

BACKGROUND

Please describe your company and your position there.

I am the CTO and Co-founder of a Mobile and IoT development company headquartered in Lviv, Ukraine. Our company has 100+ employees and we serve European and American markets with clients in the US, Germany, the Netherlands, UK, Norway, France, Switzerland

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Iterasec?

Our company had a strategic initiative to obtain ISO 27001 and ISO 9001 certifications. We decided to involve Iterasec company as our information security experts to help us build up a mature ISMS and eventually get our company certified

SOLUTION

How did you select Iterasec and what were the deciding factors?

We wanted to develop a mature ISMS and obtain ISO 27001 and ISO 9001 certification. The challenge for us was not just to make ISO 27001 a paper tiger, but also to practically improve our security processes and security awareness of our employees. We had a positive previous experience cooperating with Iterasec in other security-related projects

Describe the project in detail and walk through the stages of the project.

The project consisted of several phases and ongoing support. The main phases were: planning, implementation, internal audit, and correction. Iterasec also helped us to coordinate the certification process with ISO 27001/9001 authorized auditor. There is also ongoing support in the Virtual Information Security Manager mode

How many resources from the Iterasec team worked with you, and what were their positions?

The team consisted of 2 specialists: a Virtual Information Security Manager and a Project manager

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Within 9 months we were able to build a strong ISMS basis: established risk assessment process, performed employees ISMS training, made an internal audit and correction iteration and prepare ourselves for the certification. We also implemented/improved a number of ISO 27001 security controls and ISO 9001 quality controls

How effective was the workflow between your team and theirs?

Iterasec acted as our Virtual Information Security Team. The communication was very constructive and frictionless.

What did you find most impressive or unique about this company?

They had a good combination of practical security compliance experience and excellent project delivery

Are there any areas for improvement or something they could have done differently?

All in all we were satisfied with the project quality and overall experience

BACKGROUND

Please describe your company and your position there.

I'm the director of security at Securrency. We are a US and UAE based technology company focus on compliance and policy enforcement, and interoperability of legacy systems and new technologies such as blockchain and smart contracts.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire iterasec?

We were looking for cybersecurity experts who can help us with assessing the security of our API endpoints. We wanted to identify security flaws that can lead to potential compromise.

SOLUTION

How did you select this vendor and what were the deciding factors?

We had approached multiple vendors and had performed security assessment and analyses the quality of the findings and the testing methodology.

Describe the project in detail and walk through the stages of the project.

The team had detailed interaction with our development and business team to gain understand of API and the business functionality. This helped them in identify both technical and business logic flaws. The had shared a detailed report with findings and mitigations. they also worked with our QA team to develop test cases to identify the flaws in future code and detect it in our QA tests.

How many resources from the vendor's team worked with you, and what were their positions?

Two penetration testers and a project manager.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We had worked with multiple vendors in the past and found the issues/flaws reported to be of value and importance.

How effective was the workflow between your team and theirs?

We had frequent communication via dedicated teams' channels.

What did you find most impressive or unique about this company?

The team showed a keen interest in understanding our business. This helped identify critical business logic flaws.

Are there any areas for improvement or something they could have done differently?

No

BACKGROUND

Please describe your company and your position there.

I am the CEO of a Germany-based company specializing in security solutions and mobile development. Since 2001 the company has been focusing on mobile technologies starting from the earliest smartphones.

Our primary area of expertise is secure mobile development: we help customers protect their mobile solutions. The company’s customer portfolio includes governments, automotive brands, telecom, military, and other industries.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire iterasec?

When we start a new project we perform threat modeling as a first step of the shift-left security paradigm. In one of the new projects, we decided to perform threat modeling independently by another company. Hence we decided to engage Iterasec to support us in these activities.

What were your goals for this project?

The goal of this project was to brainstorm on the threats applicable for this type of product, evaluate risks and design respective countermeasures.

SOLUTION

How did you select iterasec?

We had a good experience working with Iterasec colleagues on some other security projects in the past.

Describe the project in detail.

The project consisted of several workshops, where Iterasec specialists performed threat modeling sessions with the dev team. They also jointly evaluated risk levels and suggested countermeasures.

What was the team composition?

The team consisted of 2 specialists: a senior application security consultant and a project manager.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The results exceeded our expectations: we encountered misuse and hacking scenarios that the development team hasn’t thought about before the threat modeling sessions.

As a result, we were able to include remediations in the product design from the very beginning.

How effective was the workflow between your team and theirs?

The communication with the Iterasec team was constructive and clear.

What did you find most impressive about this company?

We were impressed by the way they think from a hacker’s perspective, this allowed the development team to better understand security risks.

Are there any areas for improvement?

All in all, we were satisfied with the project quality and overall experience.

BACKGROUND

Please describe your company and position.

I am the Working student - Security of an IT consulting company

Describe what your company does in a single sentence.

It-Consulatancy for Fin-techs & TPPs, Banks

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Iterasec to accomplish?

• Pen-testing
• Configuration Reviews
• ISO27001 Advisory

SOLUTION

How did you find Iterasec?

Online Search

Why did you select Iterasec over others?

• High ratings
• Pricing fit our budget
• Good value for cost

How many teammates from Iterasec were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Pentesting of Network and on-premise applications, configuration review of SaaS-Applications

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Deliverables/Reports

Describe their project management. Did they deliver items on time? How did they respond to your needs?

They deliver items on time and are always ready to help. Queries were timely answered.

What was your primary form of communication with Iterasec?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

Cost-Value for their services is very good. Also very competent leadership figures.

Are there any areas for improvement or something Iterasec could have done differently?

I wish for more services to be offered because we would've liked to keep working with them.