Cyber Security Testing

Professional services of security effectiveness and compliance assessment

Cybersecurity testing services delivered by Safetech Innovations assess the effectiveness of the security measures of an organization and identify vulnerabilities that could be exploited by attackers. In addition, testing is necessary to comply with regulatory requirements and compliance with certain standards such as PCI DSS, ISO 27002, NIS, norms of the National Bank, Financial Supervisory Authority etc. By demonstrating the steps taken to secure their systems and data, organizations can also improve their trust relationships with customers, partners and stakeholders.

Safetech's testing services include vulnerability assessment, penetration testing for data networks, cloud environments, mobile applications, software code security assessment, social engineering, etc.

Methodology used for
security testing

Cyber security testing services delivered by Safetech Innovations include the following steps:

Defining the purpose of the services and developing an action plan.

We will agree to a non-disclosure agreement and agree on the scope of works, including the type of testing that will take place and the attack scenarios. In this phase we centralize the requirements, agree the objectives, agree the forms, terms, preconditions, limitations and exclusions.

Execution of the action plan.

This phase aims to discover flaws in networks, systems and/or applications using active and passive mechanisms, checking for, among other things, misconfiguration of systems and services, installed versions of applications and software patches, and insecure application design. The automated testing performed by us discovers the vulnerabilities and malware present in the infrastructure and indicates the ways to exploit existing vulnerabilities and the ease of executing the exploits.

Reporting the results.

Cybersecurity assessment actions performed during the execution phase will be documented in a report containing the completed tests, discovered vulnerabilities and associated security risks, along with recommendations for their remediation.

Information to facilitate remediation and retesting.

At this stage we will support you in understanding the problems identified and the recommendations proposed to reduce the risks associated with the discovered vulnerabilities. Any cyber security engagement carried out by our team ends with a retest, so you can be sure that the issues identified have been successfully resolved.

Specific features of our security testing services

Vulnerability scanning

Our vulnerability scanning service provides up-to-date information, by using internal and external scanners in order to accurately detect vulnerabilities in your network and cloud environments. We perform highly accurate scans of network devices, servers, web applications, databases, and other assets on-premises and in cloud environments.

Our service provides you with vulnerability management without burdening you with hardware, software and maintenance for scanning products. The service is fully managed by our dedicated team, removing administration and maintenance activities from your responsibility.

With our service you'll identify real, exploitable vulnerabilities, meet regulatory compliance needs, team up with dedicated vulnerability management experts for the duration of our services, and simplify your remediation process by applying the recommendations contained in the report we deliver.

Penetration tests

Penetration tests evaluate the security of an IT system by simulating attacks, by exploiting existing and known vulnerabilities in a way similar with the attempts of an attacker, with the difference that they will be carried out in an ethical way, with the permission of the beneficiary.

A complete penetration test will include both automated and manual tests. Manual tests will identify programming errors and analyze and confirm or deny automated test results.

Penetration testing takes place in three main approaches: black box, gray box and white box:

Black box – in this situation the testing team will not know any information about the tested systems, except for the access information of the applications (web pages, IP addresses). This infrastructure will be used for external testing of the beneficiary.
Gray Box - in this situation the test team will not know information about the systems under test, but will have a user account at a workstation with certain roles. This hybrid approach is the most common form of penetration testing because the tester can simulate a systematic attack without needing to know every detail of the target systems.
White box – in this situation the test team will have access to any information about the systems, including source code or administrative privileges. This method allows for thorough testing, allowing security issues to be discovered faster and in greater numbers.

Our team uses specific equipment and applications and has strong experience in performing network level penetration testing including wireless, operating systems, databases and applications including web, mobile, client/server, cloud services, computer attacks simulating malicious applications and degradation/disruption of service (DoS, DDoS). Safetech has work procedures in accordance with the industry good practices, which reduce the risk of affecting the target IT systems.

Software code verification

Safetech Innovations uses a four-step approach to perform code review:

Identifying the objectives of the code review - In this step we investigate the application architecture and the technology used, to find the key security specifications and threats. Based on these, we develop a document that describes the objectives of the code review. This includes a set of specific technologies and vulnerabilities to be reviewed by our experts.
Performing a preliminary scan - In the second step we use, if possible, a static analysis scanner to uncover an initial set of code-level issues that might require a detailed manual check. Scanning involves a combination of static analysis and manual verification methods to identify vulnerabilities within the code - areas where the probability of having security breaches is above average.
Performing a detailed inspection - Next, we move on to manually checking the code to identify defects that are difficult to discover using static analysis tools.
Reporting results - The final stage of verification involves analyzing the problems caused by the application architecture. Finally, we document the problems identified and make recommendations for remediation.

Social engineering services

Social engineering covers the human element of security, where assessors will attempt to access sensitive information by manipulating human psychology. Our team will determine how vulnerable are the beneficiary's employees to a potential social engineering attack and how likely they are to violate the rules and/or procedures of the company.

The phishing social engineering services offered by our company are designed to mimic attacks that malicious individuals might perform to obtain confidential information from your organization. Phishing is when a third party sends communications, most commonly via e-mail, from an apparently legitimate source - for example, impersonating an executive, colleague or service provider.

The proposed services are completed with the delivery of a full report of the findings and recommendations to mitigate the identified risks, which includes the number of messages sent, recipients, number of messages opened, number of completed forms. The report will include comparative statistics of the results obtained, compared to other campaigns carried out by Safetech Innovations, in order to have a real reference from the industry.

Why choose Safetech?

Currently counting over 60 employees, the company has dedicated teams for research and development of cybersecurity software products, implementation and support of security solutions, and Computer Emergency Response Team (CERT).

We specialized in identifying vulnerabilities, reducing risks, and creating security programs that provide the long-term conditions for your company to thrive.

Safetech specialists have advanced expertise in:

Analysis of existing/potential threats and vulnerabilities,

Risk assessment and business impact,

Consultancy to ensure the confidentiality, integrity and availability of information,

Implementation of the solutions necessary for achieving an optimal level of security, which will maintain a healthy business in the long term,

Continuous event monitoring and response to cyber security incidents.