CASE STUDY · SUPPORTED HOUSING SAAS · WEB APP · OUT OF HOURS
How Malvern Analytics had its live supported housing SaaS platform penetration tested at midnight, at no extra cost.
Malvern Analytics builds a SaaS application for supported housing providers, which hold highly sensitive data. Its co-director wanted an independent black box penetration test of the new web application from a UK, CREST-accredited company. EJN Labs moved the dates when plans changed, tested production overnight at no extra cost, and kept him in direct contact with the tester.
- Industry
- Supported housing software (SaaS)
- Market
- Registered providers and managing agents
- Service
- Black box web app pen test
- Engagement
- Black box · out of hours
- Scope
- Web application · production
- Complexity
- Live service · tested overnight
- Retest
- Included · free
The challenge.
Malvern Analytics has built a SaaS application for supported housing providers, from registered providers to managing agents. It helps them manage properties, referrals, residents and the support those residents receive. The application is new, and its customers hold highly sensitive data.
The company wanted a third party to test it, to reduce the bias its own developers would bring. It asked for a black box test: what could someone on the outside, with no credentials, do to the system?
It also wanted something to show customers. Its co-director puts it as a question. If two supported housing vendors are compared and only one has had a penetration test, who are you more likely to trust?
It approached about ten companies, in the UK and internationally, before choosing.
Why Malvern Analytics chose EJN Labs.
Accreditation ranked alongside price. Malvern searched CREST’s directory of accredited companies and found EJN Labs there.
Malvern’s impression was that platform-style providers offer a dashboard and probably no one to talk to unless something major happens. With EJN Labs, it shared a Slack channel with the tester from the start.
The start date moved more than once as Malvern’s plans changed, and the targets changed from two staging URLs to production. EJN Labs simply updated the plan.
Price mattered. Testing at midnight cost the same as testing by day.
What EJN tested.
A black box penetration test of the web application: the tester started with no credentials, as an outside attacker would. Testing ran against the production environment, overnight. We publish scope, not exploit detail.
- Black box approachNo credentials, to show what an outsider could do.
- Web applicationThe supported housing platform, in its production environment.
- Out of hoursTesting began at midnight, at Malvern’s request, so that it would not have to tell customers the app was unavailable during the working day.
How the engagement worked.
- PROPOSALScope
The process was set out in the proposal pack from the first day.
- RESCHEDULEAdapt
Dates moved as Malvern’s plans changed, and the targets switched from staging to production, with no extra hassle.
- MIDNIGHTTest
EJN Labs confirmed the start and the finish in Slack, and answered questions along the way.
- LIVESee
Findings appear in the client platform during the test, rather than only in the report at the end.
- REPORTFix
Technical, management and client-facing reports. The technical report explains how to reproduce and how to fix anything it raises. Retesting is free.
Results and business impact.
- Malvern has an independent black box penetration test it can show to customers.
- His developers could work directly from the technical report, which he says saved him time.
- The client-facing report is one he can hand to customers who ask.
- Malvern says that if it does further penetration testing, EJN Labs is the first company it will contact.
Out of hours testing was brilliant. … During the day, if we’re doing it on a production environment, I’m going to have to tell the customers, today you can’t use the app. And we can’t be doing that to supported housing clients, because these are vulnerable people. They need support day in, day out. I think that flexibility is brilliant, and keeping it within the price, I was very happy about that.
Check our accreditations yourself.
Do not take our badges on trust. These are the public registers where you can check them.
// READY?
Book a 30-minute scoping call.
Tell us your procurement or audit deadline. We’ll size the engagement the same day.
