Pricoris assists clients in improving the security of the software they develop or outsource. Our services help enterprises and product companies to improve security during project design, implementation, testing and once the software is released or running in a production environment. Our recommendations help development teams understand the business and security implications of choices made when designing and developing a product or service.
Application and Product Penetration Testing:
Pricoris’ services include:
The application, protocol, or implementation’s security posture is reported
- Identification of security weaknesses through penetration testing with or without code review
- Demonstration of weaknesses as needed to validate findings
- Simplified architecture review and threat modeling
- Characterization of the impact of a successful attack
- Recommend solutions for addressing weaknesses
- The application, protocol, or implementation’s security posture is reported
Schedule a free Cyber Security Consultation
Application Security Design Review/Threat Modelling
- Enumerate and document a system’s security design/architecture through interviews of development/engineering team personnel, documentation review, and limited source code analysis (if available)
- Perform threat modeling to overlay the design with assets, interfaces, threats, attack vectors, and controls. Document potential vulnerabilities and prioritize by risk.
- Identify gaps relative to recognized secure design patterns (including authentication, authorization, and security event logging & response)
- Enumerate conflicts between business requirements and security considerations so informed trade-offs are made
- Recommend solutions for addressing security weaknesses & vulnerabilities
- Enhance and inform other security activities like penetration testing and code review
- Adaptable to systems/applications undergoing design, prior to implementation, or in production
Application Code Review
- Examine sensitive areas of software code for potential security vulnerabilities
- Identify common security flaws, including race conditions, overflows, character set conversion problems, logical errors, bad assumptions, key management flaws, and cryptographic mistakes
- Recommend specific fixes and general coding practice improvements
- Lead groups of developers through code security review exercises to enhance competency to self-audit code
Application Fuzz Testing
- Iterative, automated security testing using selectively mutated input to provide scalable, continuous, guided coverage of the target
- Customized test harnesses targeting security-sensitive interfaces
- Use of the latest intelligent fuzzing technologies to maximize code coverage and the likelihood of discovering vulnerabilities
- Performance optimization, crash analysis, and triage, ongoing maintenance and test case evolution
- Consulting and training on developing fuzzing competency
Schedule a free Cyber Security Consultation
Security in Software Development Lifecycle (SSDLC) Program Consulting
- SSDLC Program Evaluation & Gap Analysis
- SSDLC multi-year roadmap development
- devsecops toolchain evaluation/selection and consulting
- Interim/temporary SSDLC program leadership & technical staffing
Dynamic/Static Application Security Testing (DAST/SAST)
- Fully managed, automated service enables you to assess, track and remediate common application vulnerabilities on a continual basis, to complement regular manual penetration testing and provide identification of common vulnerabilities on a more frequent basis
- Best-in-class DAST and SAST tools provided via managed cloud service, leveraging existing licenses if available
- Customer portal with reporting repository, risk dashboard, and online scheduling
Full Spectrum Attack Simulation
Pricoris emulates the tactics and techniques that real-world adversaries use in order to protect your organization. This end-to-end assessment will aim to identify weaknesses in your system configurations, staff training and awareness, and operational response.
- A Full Spectrum Attack Simulation is a bespoke, intelligence-led engagement that mimics the current threats your organization faces, designed specifically to address your specific concerns and requirements.
- Motivations for commissioning a Full Spectrum Attack Simulation can be varied but typically include:
- Improving your organization’s readiness to withstand an attack from a variety of different attack vectors.
- Help to train your security operations (Blue Team) in handling advanced and persistent attacks
- Benchmarking your security operations’ (Blue Team) performance.
- Understand and gain confidence in your organization’s resilience.
- Regulatory compliance or oversight.
The key capabilities of a Full Spectrum Attack Simulation include:
Black Team
Aims to identify weaknesses in physical controls and staff awareness (social engineering) that facilitate physical access to your premises.
Red Team
Assesses your cyber preventative controls, staff security awareness and challenges your Blue Team’s detection and response processes.
Purple Team
Combines the Red and Blue Team activity and sees attack and response experts embedded within your internal security operations (Blue Team) during a Red Team engagement.
Gold Team
Identifies improvements in your internal and external communications, crisis management procedures and decision making