Berezha Security Group

BACKGROUND

Introduce your business and what you do there.

I’m the head of inside sales at Softjourn, a software development company. We’re a service provider that mainly works with cards, payments, and fintech services.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Berezha Security?

We needed a company to conduct penetration testing for one of our client projects. We didn’t have the expertise in-house for the task.

SOLUTION

What was the scope of their involvement?

They performed penetration testing, which involved the analysis of the code of the mobile access control app for one of our ticketing clients. They looked at both the mobile app and the API side of it. After that, they sent a very detailed report on the breaches and areas that needed improvement in order to make the app more secure and protected.

The app is based on Submarine and the API is .NET. Berezha Security also worked with our venue mapping tool that helps create maps of venues. They did the same testing, with the only difference being that it’s a web-based application.

What is the team composition?

We mainly talked with the co-founder, who acted as the account manager and project manager as well. We also collaborated directly with the person in charge of testing.

How did you come to work with Berezha Security?

We were referred to them by one of our clients and employees that met them at one of the conferences they spoke at. We chose them because of their expertise; they had all of the certifications needed in order to perform the penetration testing. Their price was also better than the other companies we approached.

How much have you invested with them?

We spent less than $10,000.

What is the status of this engagement?

We started working together in June 2017 until June 2018.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

For the first project, they helped provide something we didn’t have in-house expertise for. That added value to the services we provide our clients without having to invest in getting people to learn how to do the testing and get all the certifications required.

Per their recommendations, we’ve made the improvements and changes in the code for the system. After that, they retested everything to make sure all the gaps were fixed.

How did Berezha Security perform from a project management standpoint?

I’m very happy with their availability and responsiveness. We used Skype most of the time.

What did you find most impressive about them?

They were easy to work with, responsive, and effortlessly understood our needs. They sent us the overview of the proposed solution and how to perform the penetration testing quickly. We didn’t have to spend much time managing them, and they sent the analysis and results on time.

Do you have any advice for potential customers?

The process with them is straightforward. The steps were quite clear and we knew what to expect.

BACKGROUND

Introduce your business and what you do there.

SRXP specializes in digitizing expense receipts for corporate entities. Users take pictures of their receipts on a mobile phone, and we process them and send them back to their financial administration. I'm the product owner of the technical team.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Berezha Security?

We needed a cybersecurity and security audit. Since we're growing, we wanted to ensure that we had the correct security and eliminate any major flaws in our infrastructure. After adding a credit card integration, we called Berezha Security. 

SOLUTION

What was the scope of their involvement?

We initially talked about our needs and explained our work and infrastructure. This was our first time running a penetration test. For the initial run, they suggested tests that made sense for our application. We followed their advice, and they started testing two weeks later.

They tested in our acceptance environments, telling us in advance when they blasted a high number of requests. We had to freeze our environments, since releasing new things during testing can change everything.

They updated us as soon as they checked anything. Two weeks after testing, they provided a report that explained everything we had to correct. That was nice, since we had a few bugs. They didn’t find a lot of faults, but we corrected the ones they found right away. 

Two months after the first test, Berezha Security performed the same ones. They checked the old bugs and wrote a clearer report for our clients. We're hoping to assess our security with Berezha again next year by performing black box testing on our server and database.

What is the team composition?

I had two main contacts, so I could always reach out to someone. At the end of the project, we met with the four others who tested our site's security. We met remotely with everyone who worked on our issues.

How did you come to work with Berezha Security?

We were referred to them by another partner, who said that they were professional. They recommended them specifically because they offered extra security services. They don't just perform checks for companies, but are also active in the outside world.

How much have you invested with them?

We tested Android and iOS apps, the API, and the web application for a bit less than €5,000 (approximately $5,900).

What is the status of this engagement?

We worked with Berezha between April and May 2018.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

They messaged us as soon as they found something, and we fixed all the issues in real time. This gave us more time to make the fixes. It was important that we paid attention to security. This was our first step toward guaranteeing security for our clients and giving them more trust in our platform. 

How did Berezha Security perform from a project management standpoint?

We used WhatsApp, Hangouts, and email. It was easy for us to reach each other if something happened.

What did you find most impressive about them?

Berezha’s approach was great. I'd had issues communicating with the parties testing our infrastructure, which led to a lot of bugs on our platform. Berezha let us know before they did something. I appreciated being informed about what was happening.

Do you have any advice for future clients of theirs?

They know what they’re doing. Explain your infrastructure and what they should achieve. Instead of covering everything, they will advise you on pricing and determine exactly what needs to be tested. They won't just test a lot of things for a bigger bill.

BACKGROUND

Introduce your business and what you do there.

I’m the VP of R&D for WiSpear. Our company provides Wi-Fi intelligence and surveillance services, including a variety of network security products.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Berezha Security?

We needed resources to conduct penetration testing on our products.

SOLUTION

What was the scope of their involvement?

They conducted black-box penetration testing and suggested security measures for various parts of our application. They also taught us how to use code analyzers in our technologies. I had a lot of questions along the way and added plenty of additional requirements. Despite that, they remained flexible and accommodated my needs.

What is the team composition?

I mostly worked with one of their co-founders. He was professional and worked independently.

How did you come to work with Berezha Security?

We considered several companies around the world but focused on Kyiv-based testers. Multiple people recommended Berexha Security to us, so we reached out to them. They responded promptly to my questions, and I was impressed with their professionalism and reasonable rates.

How much have you invested in them?

We spent around $10,000.

What is the status of this engagement?

Their work lasted from April–May 2018.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

They found several major security problems with our product, which allowed us to create an improvement plan. The plan identified best practices for developing our application while keeping future features in mind.

How did Berezha Security perform from a project management standpoint?

I was pleased with their quality of work and plan to continue collaborating with them on otherThey had a reasonable rate for such high-quality work. projects.

What did you find most impressive about them?

I appreciated their professionalism, flexibility, and commitment to timelines. Furthermore, they found several security issues that I hadn’t even thought about. It was easy to work with them because they were so independent. We didn’t have any conflicts or unnecessary discussions.

BACKGROUND

Please describe your company and your position there.

I am the CTO of a global web platform and payment gateway for esports.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We contracted with Berezha Security to conduct penetration testing against our web platform.

What were your goals for this project?

We needed to detect any security vulnerabilities and craft solutions. We needed to implement more stringent security policies.

SOLUTION

How did you select this vendor?

We researched several vendors in Eastern Europe, close to where we are located in Ukraine. We narrowed our search based on cost, expertise, and references.

Describe the project in detail.

Berezha Security was given access to our staging environment to conduct the testing. We provided them with multiple URLs that are critical for us to be tested and secured. They presented their findings and provided us with a timeline and cost of the next steps for protection.

What was the team composition?

We worked with two or three security consultants, who conducted the pen testing.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We held a closure meeting with their team, and they shared their findings and recommendations. We now have a greater understanding of our security needs, and we are now focused on making repairs before they conduct a free retest in 60 days.

How effective was the workflow between your team and theirs?

They maintained an efficient flow of communication through various messengers and Slack channels. We were always informed about their work and their progress.

What did you find most impressive about this company?

They utilized a number of techniques to find the vulnerable areas of our platform. They were also equipped with recommendations for how to prevent those attacks.

Are there any areas for improvement?

If they were to build an understanding of blockchain, they would be able to audit the security issues of that domain as well.

BACKGROUND

Please describe your company and your position there.

Financial company. Head of information security department

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security Group?

Penetration test including logic analisys

SOLUTION

How did you select this vendor and what were the deciding factors?

Recomendations, certifications, experiance, approach

Describe the project in detail and walk through the stages of the project.

Confidential, but in short: As per many regulations we need to check our critical infrastrature points using penetration tests.

How many resources from the vendor's team worked with you, and what were their positions?

from 4 till 5 or 6, they separate duties in between, depending from test specification. Penetration testers and security analyst.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Some issues was found by team.

How effective was the workflow between your team and theirs?

Very effective.

What did you find most impressive or unique about this company?

We liked their collaborative approach.

Are there any areas for improvement or something they could have done differently?

No, everything was covered.

BACKGROUND

Please describe your company and your position there.

I'm the co-founder of a B2B SaaS fintech named DigiFi.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security Group?

We were looking for a reputable external company to perform a penetration test as part of our annual security audit.

SOLUTION

How did you select this vendor and what were the deciding factors?

We selected them based on discussions and their expertise.

Describe the project in detail and walk through the stages of the project.

They performed a thorough audit of our platform, including detailed penetration testing of the entire system. Suggestions were presented in a clear and concise manner. Berezha Security Group was very professional throughout the entire process.

How many resources from the vendor's team worked with you, and what were their positions?

I believe around 5 people, working as a team of pentesters.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They were able to quickly identify areas of strengths and weaknesses. Their expertise and speed saved us a significant amount of time.

How effective was the workflow between your team and theirs?

They kept us updated throughout the project using a shared chat workspace. We then arranged calls as needed.

What did you find most impressive or unique about this company?

They are a relatively small company, which provides the benefit of working directly with the leadership team. We felt that they respected us and our time, while also pushing the project to quick completion.

Are there any areas for improvement or something they could have done differently?

None

BACKGROUND

Please describe your company and your position there.

I'm the ISO in a bank

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security Group?

We needed a pentest for a couple of apps

SOLUTION

How did you select this vendor and what were the deciding factors?

We have previously worked with this vendor and the job was outstanding

Describe the project in detail and walk through the stages of the project.

Their team was responsible for delivering a report of the security flaws on 2 of out major client facing apps

How many resources from the vendor's team worked with you, and what were their positions?

Two important and highly skilled members worked on this project from the vendor, and also the CEO was heavily involved.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They delivered in a timely manner the required reports

How effective was the workflow between your team and theirs?

We collaborated on the highest level

What did you find most impressive or unique about this company?

They had the flexibility to accommodate a difficult schedule

Are there any areas for improvement or something they could have done differently?

Nothing obvious

BACKGROUND

Please describe your company and your position there.

I am Security Engineer at airSlate | Business Automation

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

Web Application Security Audit

What were your goals for this project?

A web application security audit to evaluate application security

SOLUTION

How did you select this vendor?

Searched online and recommendations

Describe the project in detail.

Once we selected this vendor we had kick-off meeting to discuss project. We communicated on all additional questions during the project. At the end of the project we received report as was agreed.

What was the team composition?

Vendor`s team was composed of a project coordinator and security analysts.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Project was completed successfully with all required evidences

How effective was the workflow between your team and theirs?

All communication during the project was fast and effective.

What did you find most impressive about this company?

Ukrainian Cybersecurity Company

Are there any areas for improvement?

-

BACKGROUND

Please describe your company and your position there.

I’m the founder of an HR tech SAAS company operating in Silicon Valley.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We hired them to perform a web application security audit and penetration testing.

What were your goals for this project?

Our goal was to identify and fix security holes in our web application.

SOLUTION

How did you select this vendor?

We were referred to them by a friend.

Describe the project in detail.

The purpose of this project was to perform a grey-box security audit by giving Berezha Security’s team several accounts. We were looking to find possible security issues in our platform.

What was the team composition?

The team consisted of a few security professionals from Berezha Security’s side and two engineers from our team.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Berezha Security’s team was able to find a couple of high and medium security issues.

How effective was the workflow between your team and theirs?

They had a very effective workflow. The team at Berezha Security was very responsive and finished the testing in time.

What did you find most impressive about this company?

They’re a great team consisting of great security professionals. They were willing to give advice and suggest best practices on security topics.

Are there any areas for improvement?

No, not that I recall.

BACKGROUND

Please describe your company and your position there.

I’m a software architect at HelloFlex. Our company is making software for temporary staffing agencies in the Netherlands.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Berezha Security?

We hired them for security awareness training.

What were your goals for this project?

Our goals were to improve formal application security awareness in our team and to integrate secure development practices into the software development life cycle.

SOLUTION

How did you select this vendor?

We have already collaborated with Berezha Security in other application security projects, so it made sense to bring them in again.

Describe the project in detail.

Berezha Security led training sessions on application security to help raise awareness on our team and integrate secure development practices into the software development life cycle.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or

Our team members had positive feedback after the training. It helped us understand more about application security, and we made a plan for further security development.

How effective was the workflow between your team and theirs?

Our communication and cooperation were very good, and everything was arranged on time.

What did you find most impressive about this company?

They’re a very professional and well-organized company.

Are there any areas for improvement?

They could provide more information on GDPR compliancy; maybe it could be a part of their training for EU-compliant companies.