Palindrome

Telecom networks, connected devices and medical hardware sit alongside ordinary business software in the work of this applied information security laboratory. Palindrome Technologies describes itself as a research, applications and assurance provider with deep expertise in computer hardware, software, cloud and embedded systems, and it carries a motto of breaking code because it cares.

Security testing for applications people actually use

The firm's analysis method rests on a multidimensional framework that mixes deterministic and non-deterministic models with proprietary techniques and industry standards such as NIST, OWASP and PTES. It says it tests everything from small web applications to large communication platforms, with particular attention to software that talks to outside parties where trust cannot be assumed: web, mobile, VoIP and email applications, social engineering and wireless networks.

• Web applications: testing uses the OWASP Top 10 as a baseline, including cross-site request forgery, cross-site scripting, SQL injection, session management, broken access control in role-based and multi-tenant systems, vulnerable dependencies, deserialization, information leakage, security configuration and identity management attacks involving SAML, OAuth and XML.
• Mobile applications: static and dynamic analysis against the OWASP Mobile Top 10, covering storage access, network protocols, use of cryptography, secure platform interfaces and interface fuzzing.
• VoIP: its VoIP implementation security evaluation checks implementations for federal, carrier (VoLTE) and commercial networks against security standards and regulatory requirements.
• Email: assessment of phishing and malware exposure alongside network defences.

Research into next-generation technology

Palindrome's own research focus is on newer computing technology: wireless standards such as LTE and 5G, eUICC embedded SIM technology, IoT devices, blockchains, data mobility, autonomic computing and software-defined infrastructure. That research feeds work on vulnerable network elements, IoT and industrial devices and smartphones.

An approach called Symmetric Defense

On its current site the firm sets out a Symmetric Defense approach, meant to find and close gaps across an organization's whole attack surface, from physical premises, networks and cloud to people and third-party suppliers. It also describes incident response support, including process review, table-top exercises and adversarial emulation, and guidance on ransomware, social engineering, privacy and data breaches.

Compliance and certification

As an ISO-accredited security testing laboratory and assessor, the company says it guides customers through certification schemes including GSMA, CTIA, IEEE, NIST, HITRUST and HIPAA. Its healthcare and medical device testing supports providers and manufacturers that must show compliance.

Who it works for

The firm names telecom carriers, equipment makers, banks and other financial bodies, hospitals and clinics, schools, drug companies, utilities, insurers and government agencies among its customers.