Insights

At a Glance: Certus Cybersecurity was engaged by one of the largest companies in the world by market capitalization to provide dedicated, on-site information security services to Client on a long-term basis.

Services Provided: Certus Cybersecurity provides the services of its employees to work on-site at Client and provide software security testing and code review support services. The scope of security testing services include but are not limited to penetration testing of various web application end points, Android devices and applications, IoT devices, Bluetooth Low Energy and other security testing services as requested by Client. Certus Cybersecurity performs security code reviews for code mostly written in Java and C along other languages and assists with architecture design reviews and threat modeling.

Results:

• Identification of three critical severity vulnerabilities impacting client assets identified within the first 60 days the engagement. Our findings included a critical issue in the backend APIs that handle certificates used to encrypt payment. These issues were identified through penetration testing.
• Identification of numerous high and medium severity vulnerabilities in the MQTT workflow that subscribe various payment related topics. These issues were identified through penetration testing.
• Effectively mitigated a mutual TLS certificate issue through partnership with the Client’s development team.
• Identification of architectural flaws in the way file-based encryption was implemented on a proprietary Client device. These issues were identified through architectural risk analysis.