R&B Team

BACKGROUND

Please describe your company and your position there.

A group of large Ukraine-based companies operating in areas such as asset management, retailing, grocery business.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

We required a penetration testing for web resources and mobile applications

SOLUTION

How did you select this vendor and what were the deciding factors?

We had an open tender and we selected R&B Team due to all requirements.

Describe the project in detail and walk through the stages of the project.

Our project began with a carefully designed service plan, specialists calculated all possible risks, so that the provision of services to the company were provided without downtime for the business. At all stages, deadlines were met and the necessary consultations with qualified support were promptly provided. The technical and organizational recommendations obtained during the testing allowed to increase the security of the company's information resources and IT services.

How many resources from the vendor's team worked with you, and what were their positions?

• ISO 27001 lead auditor
• СЕН (Certified Ethical Hacker)
• OSCP (Offensive Security Certified Professional)
• CCNP (Cisco Certified Network Professional)
• CISSP (Certified Information Security Systems Professional) – PentesterLabs Unix Badge
• Tenable Engineer – eNDP certificate
• eJPT certificate (Junior Penetration Tester)
• eWPT certificate (web Application Penetration Tester)
• eWPTX_certificate (web Application Penetration Tester extreme)

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

During the test, R&B Team's employees managed to bypass some security systems and gain access to sensitive information. The vulnerabilities were unpleasantly surprised for us, all efforts were directed to their closure, so the data leak was prevented.

How effective was the workflow between your team and theirs?

The vulnerabilities were unpleasantly surprised for us. They did good job

What did you find most impressive or unique about this company?

They did an excellent job.

Are there any areas for improvement or something they could have done differently?

We can just say thanks for their job.

BACKGROUND

Please describe your company and your position there.

My name is Andrii and I'm the CISO of AP Bank. Agroprosperis Bank is the only bank in Ukraine that finances mainly small and medium-sized agricultural producers with an area of land of 100 hectares.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

We required a penetration testing for web resources and mobile applications

SOLUTION

How did you select this vendor and what were the deciding factors?

Every year, our bank holds open tenders for the purchase of cybersecurity services. The company R&B Team in its submitted documents demonstrated full compliance with all our requirements, provided the best prices and submitted certificates of technical specialists testified to competence. Our choice was clear.

Describe the project in detail and walk through the stages of the project.

One of the important factors that influenced the decision on further cooperation with the team of R&B Team was an integrated approach to any projects and a high-quality study of the relationship between implemented solutions and existing systems, which means a deep understanding of the intricacies of setting up systems and solutions and their possible vulnerabilities.

This is especially important when solving problems aimed at implementing security solutions and increasing the level of network security. When performing the analysis of information systems security, R&B Team specialists acted according to the following plan:

1. Assessment of the availability of data in open sources of information, and protection of the outer perimeter of the Bank's infrastructure.
2. Assessment of the security of the Bank's web applications
3. Formation of a general report with recommendations for eliminating the identified vulnerabilities
4. Checking the quality of recheck."

How many resources from the vendor's team worked with you, and what were their positions?

ISO 27001 lead auditor, OSCP, eJPT certificate, eWPT certificate, eWPTX_certificate

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Specialists of R&B Team company found sensitive data in the open access, which became a great surprise for us. The vulnerabilities were promptly closed. The repeated test founds no invulnerability.

How effective was the workflow between your team and theirs?

We mostly communicated over phone or chat. Whenever we had questions they quickly called us back

What did you find most impressive or unique about this company?

We were surprised by the critical of few vulnerabilities, great job

Are there any areas for improvement or something they could have done differently?

Everything was quite right and professional

BACKGROUND

Please describe your company and your position there.

I am Head of the information security department

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

Due to dynamic changes in infrastructure, we periodically conduct a penetration test of the external perimeter.

SOLUTION

How did you select this vendor and what were the deciding factors?

We held an independent tender to select a supplier. The company offered the best conditions for our bank both technically and economically.

Describe the project in detail and walk through the stages of the project.

After the security analysis, the R&B Team provided the Bank with:

• Report 1. "Assessment of the security of information systems by testing for intrusion testing"
• Report 2. "Re-assessment of the security of information systems by testing for intrusion testing."
• Consultation on eliminating the identified vulnerabilities and improving the information security management system.

How many resources from the vendor's team worked with you, and what were their positions?

– ISO 27001 lead auditor – OSCP (Offensive Security Certified Professional) – eJPT certificate (Junior Penetration Tester) – eWPT certificate (web Application Penetration Tester) – eWPTX_certificate (web Application Penetration Tester extreme

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

All the vulnerabilities were described in the reports and transferred to us, some vulnerabilities were closed due to the application of recommendations on the correct setting of the existing (previously acquired) protection systems.

How effective was the workflow between your team and theirs?

Everything was completed on time. They didn't visit our office, but we had communication at every needed moment.

What did you find most impressive or unique about this company?

We were surprised by the number of vulnerabilities, great job

Are there any areas for improvement or something they could have done differently?

High level proffesionals

BACKGROUND

Please describe your company and your position there.

I am the director of the Information Security Department of TASKOMBANK JSC

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

Due to changes in infrastructure and requirements of the National Bank of Ukraine, the Bank annually performs a penetration test of the external perimeter and web applications.

SOLUTION

How did you select this vendor and what were the deciding factors?

Our collaboration on various issues in information security began some years ago. Since that time we are ordered R&B Team for penetration testing each time.

Describe the project in detail and walk through the stages of the project.

R&B Team identified vulnerabilities for which additional protection measures have been proposed and provided with a complete description of recommendations for application. After introducing and closing the vulnerabilities, the repeated verification showed the absence of the identified vulnerabilities.

1. Assessment of the availability of data in open sources of information, protection of the outer perimeter of the Bank's infrastructure.
2. Assessment of the security of the Bank's web applications
3. Simulation of targeted attack (ART) using social engineering methods
4. Formation of a general report with recommendations for eliminating the identified vulnerabilities.
5. Checking the quality of recheck.

How many resources from the vendor's team worked with you, and what were their positions?

TEAM – ISO 27001 lead auditor – OSCP (Offensive Security Certified Professional) – eJPT certificate (Junior Penetration Tester) – eWPT certificate (web Application Penetration Tester) – eWPTX_certificate (web Application Penetration Tester extreme)

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

R&B Team specialists identified vulnerabilities for which additional protection measures have been proposed and provided with a complete description of recommendations for application.

How effective was the workflow between your team and theirs?

Everything was completed on time. We had communication at every needed moment.

What did you find most impressive or unique about this company?

They did an excellent job.

Are there any areas for improvement or something they could have done differently?

Everything was quite right and professional

BACKGROUND

Please describe your company and your position there.

AVTEK is the official distributor OF FORD TRUCKS and the official dealer of MAZ, MTZ, SOLARIS, RASCO, KASSBOHRER, HIDRO-MAK, ERDEMLI, HYVA.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

We required a SIEM as service for our company

SOLUTION

How did you select this vendor and what were the deciding factors?

We had an open tender and we selected R&B Team due to all requirements.

Describe the project in detail and walk through the stages of the project.

Technical capabilities of the service that was presented by the R&B Team:

1. Security analytics
2. Detected intrusions
3. Log data analysis
4. File integrity monitoring
5. Detection of Vulnerabilities
6. Evaluation of the Configuration
7. Incident response
8. Compliance with regulations
9. Cloud security monitoring
10. Safety containers (software development)
11. Constant scanning of the system with the goal search for known CVEs in programs on endpoints
12. System inventory
13. File System Integrity Monitoring (FIM)
14. Preparation of reports for management and audit teams

How many resources from the vendor's team worked with you, and what were their positions?

We have a team of engineers who do a regular job. Also, two engineers work with project 24/7

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Benefit from implementation and application SIEM system was that it is significant accelerates the process of processing IS incidents and obtaining the necessary information about IS events. That is actually what we needed

How effective was the workflow between your team and theirs?

Everything was completed on time. With good result

What did you find most impressive or unique about this company?

I appreciated they did a really good job

Are there any areas for improvement or something they could have done differently?

Everything was quite right and professional

BACKGROUND

Please describe your company and your position there.

My name is Igor. I am the Head of the Information Security Department of Ukrainian insurance company "Oranta".

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

We request an annual social engineering perimeter pentest and web application pentest

SOLUTION

How did you select this vendor and what were the deciding factors?

Our collaboration on various issues in information security began 5 years ago, when we chose the best solution to protect the network. The team invited us the decision and sold itself as highly qualified specialists. Therefore, we are still in a joint work with them.

Describe the project in detail and walk through the stages of the project.

R&B Team specialists acted according to the following plan:

1. Assessment of the availability of data in open sources of information, protection of the outer perimeter of the Bank's infrastructure.
2. Assessment of the security of the Bank's web applications
3. Simulation of targeted attack (ART) using social engineering methods
4. Formation of a general report with recommendations for eliminating the identified vulnerabilities.
5. Checking the quality of recheck.

How many resources from the vendor's team worked with you, and what were their positions?

• ISO 27001 lead auditor
• OSCP (Offensive Security Certified Professional)
• CCNP (Cisco Certified Network Professional) –
• eJPT certificate (Junior Penetration Tester)
• eWPT certificate (web Application Penetration Tester)
• eWPTX_certificate (web Application Penetration Tester extreme)

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

All the vulnerabilities were described in the reports and transferred to us, some vulnerabilities were closed due to the application of recommendations on the correct setting of the existing (previously acquired) protection systems.

How effective was the workflow between your team and theirs?

They did a good job. We did not have questions with no answers

What did you find most impressive or unique about this company?

They were a team of high-quality professionals.

Are there any areas for improvement or something they could have done differently?

We can just say thanks for their job

BACKGROUND

Please describe your company and your position there.

Kusum — a group of pharm companies employing more than two thousand highly qualified professionals in Ukraine, India, Moldova, Kazakhstan, Uzbekistan, the Philippines, Myanmar, Mexico and Kenya. And I'm Dmitro, the Head of the Information Security Department of this company

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

Implemented the Privileged Access Management solution

SOLUTION

How did you select R&B team and what were the deciding factors?

We asked colleagues in our sphere to recommend us a good cybersecurity local company. And now, 5 years from the beginning of our first project, we still work together.

Describe the project in detail and walk through the stages of the project.

Great customer oriented service. When we first faced the need to control our priveledged users and access to corporate systems across whole infrastructure R & B Team in shorten time have prepared Proof of Concept project to show us how the system that is being proposed will fit our needs. It was a Priveledge Access Management solution.

It gave us visibility across all administrators connection sessions with screen recording that already helped us on PoC stage to troubleshoot miscronfiguration of service/servers availability caused by human factor. System have frendly user interface. It's very easy to search interested moments\session\events based on server or user query, etc... or even entered command.

In last case system will link you properly to the moment of the interested action in recording. Also there are great features like access aproving that make us self-confident that access will be given only if it will be accepted by major administrators for example, time\day based access that keep access available only during working hours.

The main thing as for me that i liked is a command controll policies that help us inditificate and prevent consious and unconsious insider treats and keep our infrastructure safe. In addition PAM-solution was finded wery usefull when you are dealing with outsource companies\workers - system write session metrics like whole session time, activity time and idle time.

System can be integrated with 2FA services to keep access more secure. Alerting, notification, user session interacting - its all also there. And it is only network-based solution and there is no need to install and administer aditional software on endpoints Solution have been already inegrated to our infrastructure and work day by day. Thanks for fast interaction and great results.

How many resources from the R&B Team team worked with you, and what were their positions?

3 professionals

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Specialists of R&B Team company found a huge number of invulnerability.

How effective was the workflow between your team and theirs?

Everything was completed on time and with good results.

What did you find most impressive or unique about this company?

I appreciated they did a really good job

Are there any areas for improvement or something they could have done differently?

Everything was on high level

BACKGROUND

Please describe your company and your position there.

I'm the CIO of JSC BANK UKRAINIAN CAPITAL — Ukrainian commercial bank, which was registered by the National Bank of Ukraine on December 25, 1992

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire R&B Team?

Due to dynamic changes in infrastructure, we annually perform a penetration test of the external perimeter.

SOLUTION

How did you select this vendor and what were the deciding factors?

We asked colleagues in our sphere to recommend us a good cybersecurity local company. And now, 5 years from the beginning of our first project, we still work together.

Describe the project in detail and walk through the stages of the project.

"Our project began with a carefully designed service plan, specialists calculated all possible risks, so that during the provision of services to the Bank were provided without downtime for business. When performing the analysis of information systems security, R&B Team specialists acted according to the following plan:

1.  Assessment of the availability of data in open sources of information, protection of the outer perimeter of the Bank's infrastructure.
2.  Assessment of the security of the Bank's web applications
3. Simulation of targeted attack (ART) using social engineering methods
4. Formation of a general report with recommendations for eliminating the identified vulnerabilities.
5. Checking the quality of recheck.

After the security analysis, the R&B Team provided the Bank with: 

• Report 1. ""Assessment of the security of information systems by testing for intrusion testing"" 
• Report 2. ""Re-assessment of the security of information systems by testing for intrusion testing."" 

Consultation on eliminating the identified vulnerabilities and improving the information security management system. R&B Team reports contain the following information: - Resume for management. Summary of test results:

• The purpose of testing.
• Description of the purposes of testing - Scope.
• Defining the scope of testing - Description of methodology.
• Methods and tools used by the Contractor during the test and its individual stages - Test results.

Detailed test results and recommendations containing the following information:

• Names of vulnerabilities
• List of vulnerable systems (services)
• Level of risk
• Description of vulnerabilities
• Vulnerability testing actions (description of attacks)
• Evidence of verification
• Recommendations for elimination

At all stages, deadlines were met and the necessary consultations with qualified support were promptly provided. The technical and organizational recommendations obtained during the testing allowed to increase the security of the bank's information resources and IT services."

How many resources from the vendor's team worked with you, and what were their positions?

On our project worked:

• ISO 27001 lead auditor
• Offensive Security Certified Professional
• Cisco Certified Network Professional
• Junior Penetration Tester
• web Application Penetration Tester
• web Application Penetration Tester extreme

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Over 5 years, R&B Team has found more than 50 different vulnerabilities (15 of them critical), which we successfully closed, which is evidenced by repeated testing over them.

How effective was the workflow between your team and theirs?

Everything was completed on time. They didn't visit our office, but we had communication at every needed moment.

What did you find most impressive or unique about this company?

I appreciated they did a really good job on every single project during our five years partnership.

Are there any areas for improvement or something they could have done differently?

We closed all vulnerabilities by themselves, next time we wanna do it by R&B Team's company