Offensive Security

Vulnerability Disclosure Policy

Pretera is committed to protecting the security of our customers, and therefore has implemented and maintains the technical and organizational measures (&ldquo;TOMS&rdquo;) described in this document.
This document details the TOMS employed by Pretera for protecting customers data and assets from unauthorized access, corruption, and loss.
1. Pretera Policies and Procedures At Pretera, we practice physical security and information security policies and procedures for our services that are:
(a) Aligned with applicable prevailing industry standards and applicable laws; (b) Designed to ensure the security and confidentiality of our customers and their data; and (c) Constructed to protect against anticipated threats or hazards to the security or integrity of our systems, including unauthorized intrusion, disclosure, misuse, alteration, destruction, or other compromise of such information. Upon Customer&rsquo;s prior written request, we can provide our customers a copy of our current security policies.
2. Awareness and Training All our employees are required to receive training on information security policies and risks at least on an annual basis and as part of our onboarding process for all new employees, including contractors. Besides this, we continue to provide its employees security training in order to develop products consistent with industry standard security considerations.
3. Personnel Security As part of our recruiting and HR policy, we conduct pre-employment background checks as permitted by applicable law for all employees.
4. Access Controls We maintain policies and processes to control and secure access to our own and customer&rsquo;s data based upon the principle of least privilege through secure authentication, authorization mechanisms, and access control rules that take into account the risk associated with the particular information system and the type of information stored therein. These processes include multiple layers of access controls such as firewalls, tokens, security keys, and authentication.
User access management to our systems includes processes around user registration, access provisioning, management of privileged access rights to information, information systems, and removal or adjustment of access rights.
5. Data Segregation Client data is being segregated on a dedicated tier, which is not accessible through the internet and is made available only to the people in charge in a secured manner e.g. using dedicated access provisioning and access review cycles.
6. Viruses, Malware, Phishing, etc. We continuously seek to implement best practices and security technologies to protect our environment. We therefore work with leading security vendors to deploy various tools to mitigate the threat of viruses, malware, and phishing.
7. Encryption We continuously perform encryption to mitigate the risk of unauthorized disclosure or alteration of our data while in transit or at rest. Cryptographic keys shall be protected against unauthorized access, disclosure, modification, and data loss.
8. Workstation Protection Pretera has implemented protection measures on end-user devices and monitors those devices to be in compliance with the security standard requiring hard drive passwords, screensavers, antivirus software, firewall software, unauthenticated file sharing, hard disk encryption, and appropriate patch levels. Controls are consistently applied to detect and remediate workstation compliance deviations.
9. Business Continuity Pretera seeks to maintain continuity of our operations through business continuity, redundancy, appropriate staffing of incident response personnel, and timely recovery of our critical processes and systems.
10. Incident Response In case of an actual or reasonably suspected Data Incident, we will immediately:
(a) Take all necessary measures to contain the Data Incident and ensure that the same or similar Data Incident does not recur; and (b) Investigate the Data Incident and cooperate with our customers (if applicable) in responding to any disclosure obligation related to the Data Incident. 11. Customer Data Retention and Disposal Customer Data is retained until the expiration or termination of the agreed contract, after which it is disposed of in accordance with the appropriate policies in place.
12. Change Control Pretera may change the TOMs from time to time to adapt to the evolving security landscape and will notify Customers of such changes.

Technical and Organizational Measures

With the constantly growing use of interconnected technology, the majority of companies have a widespread footprint of their network. It is undoubtedly difficult to think that every access point of your network is as secure as it should be.

Having several monitoring tools for your network is certainly necessary however not all malicious activities are captured by those tools. Network penetration tests aim to find places a hacker might exploit in various systems, networks, network devices (think routers, switches), and hosts. We look for ways a hacker might find real-world opportunities to compromise a company, gain access, or unauthorized access to sensitive data. By finding loopholes in the network and navigating through them, our manual network penetration testing not only helps to identify vulnerabilities but also assess the impact of those with the ultimate goal of improving an organizations external and internal security posture.

Network Security

Are you launching a new application for your business, upgrading an existing one, adding new components or updating security patches ? Do you want to ensure that the application is secure before its release? Are you trying to prevent malicious outsiders from exploiting any potential vulnerability and damaging your business ?

Application penetration testing, also known as ethical hacking, is the manual process of evaluating the security of an application by simulating an attack on it, mimicking the actions of malicious actors. The purpose of application penetration testing is to identify vulnerabilities and weaknesses in an application that can be exploited by attackers to gain unauthorized access, steal data or cause other types of harm. The high cost of a successful cyber-attack means no company should wait for a real-world scenario to play out before going on offense.

Application Security

Have you invested in security technology and raised awareness in your company, and now you want to test whether your overall security posture has improved? Or perhaps you want to assess your organizations readiness in case of a cyberattack? If so, red team testing is the way to go.

Red team testing is a cybersecurity simulated attack where a group of security professionals attempts to replicate real-world attacks and penetrate the organization undetected. The red team is given permission to use any necessary tactics, including spear phishing, ransomware, identity spoofing, session hijacking, injection attacks, social engineering, and psychological manipulation of employees. The goal of red team testing is to identify weaknesses in the organization's defenses that could be exploited by real attackers, mostly targeting human behavior. Red teaming is an accurate way for organizations to assess their security posture and identify areas where they can improve their defenses. It answers questions such as how quickly intrusions are detected, where the most impactful vulnerabilities lie, and how effective your SOC or SIEM is. Which functions in security products are underused and which products can be discarded? A red team exercise aims to raise the security bar, challenge security teams and provide more confidence after identifying and improving security controls.

Red Teaming

Cloud solutions are becoming increasingly popular among organizations due to their scalability, cost-effectiveness, and flexibility. The flexibility and autonomy offered by solutions like Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) technology also expose organizations to new security threats.

Cloud penetration testing attempts to simulate a cyber attack on a cloud computing system or service. We therefore use various tools and techniques to simulate attacks that could be used by malicious actors, such as hacking into the cloud providers infrastructure or accessing sensitive data stored on the cloud. The goal is to identify security weaknesses or gaps in the cloud providers security controls and to provide recommendations for improving the security posture of the cloud service. As more and more organizations are storing sensitive data or host critical applications in the cloud, it is essential to continuously assess the security posture and identify vulnerabilities before they can be exploited. It is an important part of a comprehensive cybersecurity strategy for organizations that use cloud services. It helps organizations to assess the security of their cloud environment and take necessary measures to improve their overall security posture.

Cloud Security

After conducting security assessments of different kinds, companies usually struggle to define and implement the necessary steps to tackle potential vulnerabilities.

Pretera has an extensive experience in cyber security consulting and helps organizations to develop and implement comprehensive cybersecurity strategy, provides recommendations for improving the organization's cybersecurity posture and helps the organizations deploy security technologies and training employees on security best practices. We can act as your cyber security partner throughout your journey to become a secure organization and stay ahead of challenges threatening your business.

IT Security Consulting

As different research points out, the human factor remains the weakest link when it comes to cyber security. Based on the latest Gartner report, more than 80 % of successful cyberattacks have materialized as a result of humans within an organization. Cybercriminals are constantly evolving and devising new methods to exploit vulnerabilities and steal valuable data from businesses.

They also use social engineering techniques to manipulate human behavior and emotions. It is therefore not surprising that social engineering attacks, such as phishing, spear phishing, and business email compromise (BEC), are highly successful. We help organizations educate and train employees to quickly identify these threats, by providing them interactive awareness sessions and organize dedicated social engineering campaigns (such as phishing, vishing and/or smishing). In collaboration with your company, we will define scenarios which are most tangible for your people and bring their awareness to the desired level. A well-defined cybersecurity awareness training can help significantly reduce the cost and number of security incidents in your organization. It helps employees to understand the importance of security measures and procedures, as well as how to recognize and respond to potential threats.