Client Innocode develops a digital media and publishing solution for newspapers and local communities.   Goals Innocode engaged Iterasec in a holistic security review of the solution: – Several customer-facing applications– Mobile Apps– API/Backend– Cloud and container security audit Solution and results Before starting the pentest, Iterasec wanted to perform a joint threat modeling exercise. First, Iterasec performed an introductory workshop for the product team, explaining the methodology and basics of threat modeling. Later, after preparing a DFD diagram, Iterasec facilitated two threat modeling sessions with the team.   Going forward, Iterasec started with application security testing of the web and mobile applications and API interfaces. The tests followed OWASP ASVS/MASVS but also focused on finding non-obvious vulnerabilities and chaining them into potentially efficient attacks.  Next, Iterasec performed a Google Cloud Platform and Kubernetes security audits, mainly relying on CIS Benchmark tools and manual findings analysis.  All the findings were summarised in the final pentest report along with the recommendations.  Iterasec supported the team in fixing security issues and ensured security fixes were applied correctly.  The team consisted of 1 Senior Security Consultant, 2 Pentesters and 1 Delivery Manager.

Client Securrency is a fintech company that provides an infrastructure for digital assets markets. The company engaged Iterasec to perform security testing of the different product components.  Cooperation We’ve been working with Securrency for over 3 years now. Initially started with web application penetration testing, Iterasec was also involved in the security of mobile Apps. Iterasec also performed a series of smaller API pentest, allowing the team to build and deploy its product iteratively, ensuring it is secure at each product development leap.

Client Open Social is a company that builds community software for leading organizations like the United Nations, Greenpeace International and the European Commission.   Cooperation Open Social reached out to Iterasec in 2021 requesting to build ISO 27001 certification. The first project, Guided ISO 27001 implementation, took about a year and the company successfully passed the certification.  After that, we’ve been working on several other projects, including the pentest of the Open Social Drupal-based product, performing security code reviews, incident management consulting, information security training, etc.  Iterasec remains a trusted cybersecurity partner for Open Social, providing on-the-spot cybersecurity services. For a small company such as Open Social, this is much more efficient as compared to retaining its own cybersecurity team.