We assess how applications and APIs enforce access rights and how networks isolate server administration from public services. For each confirmed finding, we explain which privileges an attacker needs, what impact we demonstrated and how to fix the issue.
What we test
We select risks and controls with you based on your applications, user roles and network zones. These examples show what an assessment can cover.
We manually check which records users can read or change and which actions their roles permit. We assess workflows covering registration, file uploads, approvals and document signing.
Example: access to another company’s invoiceWe assess exposed services, service account privileges and remote administration settings. When an automated check flags a vulnerability, we verify the installed package version, patch status and configuration of the affected service.
We compare the network flows you intend to allow with the services reachable from each agreed segment. For example, an application may need a database connection while its access to the database management interface should be restricted.
The deliverable
We report technical severity with a CVSS score, its version and scoring vector. Priority depends on where the service is reachable from, the privileges required and the data or operations at risk. The report distinguishes what we observed from consequences that remain hypothetical.
Engagement
Before we start, we need your written authorization specifying the scope, dates and permitted roles. The system owner or an authorized representative must grant it. For web applications, we select checks from the OWASP Web Security Testing Guide (WSTG) that match the features in scope. For production work, we agree a testing window, operational limits and a contact who can stop the assessment.
For each finding, we document the affected component, the starting privileges and the observed result. If an issue needs immediate action, we notify the designated contact during the assessment.
Your team reviews the findings and supporting evidence for factual accuracy before we finalize the report. The scope can include one retest after remediation. For each finding we reassess, we record the system version, date and outcome. You can also arrange periodic checks of selected functions or a review after a significant system change.
Who performs the tests
Martin Růžek conducts the tests. He is the managing director of NOVERIA networks s.r.o. and has more than 20 years of experience in IT.
If NOVERIA is involved in developing or operating your system, we will tell you before the contract is signed.
Contact
Tell us which systems you want assessed, the objective and any operating constraints. We will reply by email to discuss the scope.
You can also use this form to report a security issue on NSA.cz.
