Client Background:

Headquartered in Sydney, Australia, the customer is a dynamic and fast-growing software company developing leading technology solutions to disrupt the incident, emergency, and crisis management sectors. Their offerings provide businesses with the required intelligence to manage a major crisis or business disruption – as it unfolds anywhere around the world.

Business Challenge:

Recently, the company moved their application from traditional infrastructure to AWS cloud environment. To ensure that their security measures were effective enough to protect all the assets from unauthorised access, the customer decided to evaluate the security level of their information system and the public facing web applications, identify potential vulnerabilities and mitigate the subsequent risks. The customer was looking for a reliable and trusted partner, and they engaged SecureTriad to perform security assessment of their AWS environment.

Solution:

The penetration testing approach followed by SecureTriad was based on the OWASP and PTES security testing guidelines.

SecureTriad carried out the following activities as a part of the engagement:

• Gathering of information from public resources and analysis
• Discovery and assessment of all vulnerabilities in the target systems and applications with the use of known automated tools like Burp Suite Professional, Nessus etc.
• Black Box and White Box penetration testing
• Manual and automated exploitation techniques to evaluate if the system/ application can be compromised from external network from a hacker’s perspective
• Along with standard test cases, attempts were also made to identify weaknesses in the business logic of the application

Besides the revealed technical issues, the penetration testing exercise helped evaluate the readiness of the company to recognise an attack and take prompt security measures to eliminate possible negative impact.

Results:

• Customer was sent regular updates of the penetration testing progress
• Customer was notified immediately each time when a critical or high vulnerability was identified since they posed immediate threat to the application/network.
• After the completion of testing, a detailed report was produced including executive summary and technical findings. The report also included detailed recommendations with useful links which would assist the developers to quickly remediate the issues.
• Entire penetration testing exercise helped the client to evaluate the security posture of their systems and application.
• SecureTriad was able to uncover several critical and high vulnerabilities which, if exploited by a cyber attacker, would result in complete compromise of the systems/application.

Prior to engaging SecureTriad, the customer had conducted penetration testing of their application around 5 times by partnering with a different services provider. However, the critical vulnerabilities which SecureTriad was able to uncover were not identified during any of the previous testing engagements.

Feedback from customer:

SecureTriad performed network and application pen testing for our company. SecureTriad has got sound experience in this domain and are very thorough in their testing practices. They kept us in loop on the findings and helped us understand the approach they are taking to perform the testing.
We are very satisfied with the outcome and will be using their services in the future too.