- Companies preparing for an ISMS-P assessment
- For organisations that need to test vulnerabilities in services within the assessment scope and document remediation results and retest history.
- Web applications and APIs approaching launch
- When the security of core workflows such as registration, payments and administrative functions needs to be verified before launch.
- Services handling customer information
- When data separation and access permissions between organisations or users need to be verified.
- Platforms with complex permissions
- When users, staff and administrators have distinct permissions, or the permission model needs to be reassessed after functional changes.
Web & API penetration testing
For ISMS-P assessment preparation and data protection,
we assess web and API vulnerabilities and provide evidence to support remediation.
What we assess
Korean assessment and security
requirements
We define technical checks after reviewing the standards applicable to your organisation and the systems in scope.
- ISMS-P assessment preparation
- We compile findings, remediation recommendations and retest history as supporting material for the vulnerability assessment and remediation requirements within the certification criteria.
- Reviews relating to Korean personal data protection law
- Taking Korea’s Personal Information Protection Act and Standards for Measures to Ensure the Safety of Personal Information into account, we review applicable technical areas such as access permissions, authentication, encryption and access logs.
- Preliminary reviews for electronic financial services
- We identify web and API vulnerabilities in electronic financial services and document the improvements needed to address security requirements.
- Critical information infrastructure guidance
- We incorporate the technical checks applicable to the systems in scope from KISA’s Detailed Guide to Technical Vulnerability Analysis and Assessment for Critical Information Infrastructure.
We support technical assessments and the preparation of review documentation. Where certification assessments or statutory evaluations are required, we first confirm the applicable standards and provider eligibility requirements.
Reports and remediation recommendations
- Risk summary
- We outline the impact on your service and the issues to address first.
- Detailed vulnerability report
- We provide reproduction steps, request and response evidence, severity assessments and remediation recommendations.
- Results briefing and retest records
- We review the results with your development team and document retest outcomes for the agreed remediation items.
Detailed assessment scope
OWASP WSTG guides our assessments, tailored to the service architecture and the agreed scope.
- Authentication and sessions
- We verify that login, logout, password changes, and token refresh and expiry behave according to the defined policy.
- Object- and function-level access permissions
- We assess access to other users’ data (BOLA/IDOR), data separation between organisations, and permission boundaries between standard users and administrators.
- Inputs and business workflows
- We review the handling of input values and uploaded files, along with security configuration. We also test whether changing request sequences or values can bypass business rules.
Project information
- Preparation
- We need a list of target URLs and APIs, key functions, user roles and role-specific test accounts. During consultation, we explain what you need to prepare.
- Scope, schedule and quotation
- We prepare a quotation after reviewing the target functions, number of accounts, API scope and preferred schedule. Targets and exclusions are agreed before work begins.
- Operational impact
- We test authorised targets only. Production and test environments, time windows, permitted requests and stopping criteria are agreed in advance.
- Results briefing
- We explain reproduction conditions and remediation approaches to the developers responsible. The format and participants are agreed before work begins.
- Retesting
- The items, timing and number of retests are agreed when discussing the quotation. Any functions or scope added later are agreed separately.