NIS2 and DORA readiness
- Gap assessment against NIS2/DORA with a prioritised remediation plan.
- Incident reporting procedures and tabletop exercises for management.
- Third-party and supply-chain risk reviews for critical IT services.
- Evidence packs for auditors: policies, logs and control traceability.
Audit and Information Security Consulting
We help organisations build an information-security programme and demonstrate it — ISO 27001, GDPR, NIS2, and, when a client requires them, frameworks such as SOC 2, PCI DSS, HIPAA, NIST 800-171 or CIS Controls.
The work covers policy and architecture, security of systems we implement, and audits against the standard the contract actually names. US-centric programmes (FedRAMP, FISMA, DoD RMF) are in scope only when the client is under those rules; they are not our default offering in the EU.
We balance operations, IT and cybersecurity so the control set is usable, not a binder that nobody runs.
Certifications:
Certified Information System Security Professional – Information Security System Engineering Professional (CISSP-ISSEP)
Certified Information System Security Professional (CISSP)
Certified Information Systems Auditor (CISA)
Certified Ethical Hacker (CEH)
IT Infrastructure Library (ITIL)
and more..
QData’s team of experts specialize in a wide range of security services. These include web penetration testing, utilizing the OWASP Top 10 methodology, web penetration testing, OWASP API security, as well as iOS and Android mobile vulnerability assessment. Additionally, we offer source code reviews for various programming languages such as .Net, Java, and PHP, as well as vulnerability assessments, penetration testing, SIEM team services for cloud security (AWS and Azure), file integrity monitoring, event monitoring, endpoint security and encryption, data loss prevention, network access control, threat monitoring (email traffic and analysis malware), privileged access and identity management.
Our team has a wealth of experience in both black box and white box testing, and they offer VAPT (vulnerability assessment and penetration testing) services for web applications, web, and mobile applications, source code reviews, malware analysis, server hardening, and security analysis. We adhere to industry standards such as OWASP Testing Guide v4 (OTGv4), SANS Top 25, NIST SP 800-115, and PCI DSS, to ensure that clients can focus on their business without worrying about security threats.
QData uses the latest testing methodologies such as OWASP Top 10 and SANS Top 25 for testing web applications. We perform manual and automated penetration testing for vulnerabilities such as injection flaws (e.g. SQL, NoSQL, OS, and LDAP injection), broken authentication, exposure of sensitive data, external XML entities (XXE), broken access controls, security misconfiguration, cross-site scripting (XSS), insecure deserialization, use of components with known vulnerabilities, insufficient logging and monitoring. We also conduct source code reviews for technologies such as Java, .NET, PHP, etc.
For manual web application penetration testing, QData checks for configuration and deployment management, identity management, authentication, authorization, session management, input validation, error handling, weak cryptography, business logic, and client-side vulnerabilities. We use various automated tools such as Acunetix, Burp-Suite, Netsparker, Nexpose, Tenable, IBM AppScan, HP Fortify, and W3af for network penetration testing.
QData provides external and internal network penetration testing and we perform manual and automated testing using tools such as OpenVas, Wireshark, Nessus, Metasploit, Armitage, and Scapy. QData manually check IDS/IPS, servers, network switches, routers, VPNs, firewalls, antiviruses, passwords, etc.
QData’s source code review services cover both front-end and back-end languages. They use standard methodologies such as OWASP Top 10 and perform both manual and automated reviews for web vulnerabilities including SQL injection, cross-site scripting (XSS), CSRF, RFI, LFI, authentication bypass, etc. We use tools like CheckMarx, IBM AppScan source for analysis, and Microfocus HP Fortify.
Finally, we offer security analysis and server hardening services, including regular checks and maintenance of systems and servers to ensure compliance. We also provide daily automatic application checks and monitor all critical network and server components, supporting various platforms such as CIS desktop and network benchmarks.