Portfolio

Customer

The Customer is engaged in an online sale of printed and electronic books. The company develops two business lines, so it runs two separate ecommerce websites: the first one targets the widest audience of readers and is publicly available, while the second one sells academic books required by colleges and universities and is intended for students only. The access to the academic e-store is available upon selection of the educational institution and registration.

Challenge

The Customer had both ecommerce websites built on Magento 1. As the end of the platform support was approaching, they were looking for a Magento-competent development team to migrate them to Magento 2. Hosting their ecommerce presence on AWS, the company also questioned whether its cost and scalability was optimal for them and considered hosting migration.

The Customer saw migration as an opportunity to introduce some website optimization. As they were looking to increase sales in the publicly available e-store, they decided to refresh its digital user experience and visual design. Also, they wanted to integrate their academic e-store with the Amazon marketplace and offer students a backup plan to buy there in case a required book was out-of-stock in their store. To facilitate the management of the e-stores, the Customer wanted to unite them into a single website.

Solution

Code and theme migration to Magento 2

Chosen as a Magento migration vendor, We started the project with the code audit and revealed 12 custom-built interdependent modules of poor code quality. The audit allowed for accurate assessment of the work and time scope needed for trouble-free migration. Due to the difference in the software architecture style and code implementation between Magento 1 and 2, lift-and-shift migration of custom modules could end up with functionality breaks and serious performance issues (e.g., up to 50-second page load). To avoid such risks, our team performed code refactoring and then re-coded all custom modules to be compliant with Magento 2.

Tasked to add a contemporary look to the web stores, We opted for a ready-made Magento 2 theme and customized it to reflect the Customer’s brand.

Hosting migration to MageMojo

The Customer hosted their Magento websites on AWS and employed Amazon SQS (Simple Queue Service) and SNS (Simple Notification Service) services. Amazon SQS was used to render books requested by professors and add them to the rosters of different courses and academic levels. Amazon SNS allowed for the simultaneous processing of professors’ requests. We analyzed the Customer’s hosting needs and offered to migrate the websites to MageMojo. Created specifically for Magento-powered websites, it made for a more budget-friendly choice. As a part of the infrastructure (Amazon SNS and SQS, email services) and resources (images) were required to leave on AWS, Our team custom-coded integration between Magento and AWS and enabled fast data exchange.

Magento integration with the Amazon marketplace

Our developers enabled students visiting the Customer’s academic e-store to buy e-books on Amazon without leaving the website. In this scenario, a user journey unfolded as follows: after logging in, students saw a full roster of the required literature. The books in-stock were available for adding to the shopping cart. The books out-of-stock were shown as available for purchase on Amazon. However, the web store didn’t redirect users to Amazon but generated one more shopping cart and processed the purchase and payment transaction within the website.

Multistore and multisite setup

Upon the migration, Our developers formed the websites into a Magento multistore for the Customer to conveniently manage both web stores from the same admin panel.

Given that the Customer worked with multiple publishers, our team enabled a multisite Magento instance. Each publisher had a separate store view where readers could find the full book collection and brand information. At the time of release, there were 100+ publishers’ websites created.

Results

Both e-stores have been migrated to Magento 2 and merged into a multistore successfully with all their custom functionality saved and the websites’ performance not disturbed. The Customer witnesses sales growth as digital user experience has been generally improved and students have gained an opportunity to see and buy books beyond the academic program.

The Customer plans to continue the collaboration with us to migrate their ecommerce presence to a PWA.

Technologies and Tools

Magento Open Source 2.3.3, PHP 7.3, Elasticsearch 6.5.4, MySQL 5.7, Nginx 1.9, Varnish 6.2, Amazon SQS, Amazon SNS

Customer

The Customer is a Norwegian company with offices in Oslo, San Francisco and Bogota. Established in 1998, the company delivers award-winning Web Content Management solutions based on a flexible and easy-to-use Java product compliant with web standards. The Customer’s client base includes large multinational companies such as Toyota, Posten, Statistics Norway, Gjensidige and Jøtul.

Challenge

The Customer realized that their product – a content management system (CMS) written in Java – needed a technological revamp to overtake other market players in the forthcoming years. They wanted to offer users a top-notch digital experience, especially in the light of the booming user interface (UI) technologies like JavaScript and Ajax. So, the Customer chose US as a vendor with a cross-domain experience in web app development to create a totally new product that would allow the company to boost its market visibility worldwide and especially in the USA.

Cooperation

The success of the project was preceded by a persistent hands-on struggle for the right technological solution to ensure a safe and predictable foundation for online presence of any kind.

Upon passing a set of strict tests, 5 Java Developers were enrolled on the project to augment the Customer’s development team. Although they were mostly to develop the application’s front-end, their ability to easily switch to the back-end if needed was of a particular advantage.

The project kicked off with Vaadin – an open source web application framework. Owing to its server-side architecture, it would enable both development teams to focus on their strong suit – Java programming. However, it came out soon that the framework was not flexible enough to create a CMS as dynamic and smooth as it was anticipated.

The Customer decided to try the Ext JS framework. In 1 year, the application’s code-base grew so big that further development and maintenance were next to impossible.

Trying to find the right solution, Our Team and the Norwegian company came up with an idea to develop their own object-oriented framework and apply it with Microsoft’s TypeScript to replace Ext JS entirely. With the unique framework, the Customer managed to protect their API from any unpredictable change as well as enable users to employ the same components that the CMS was developed with. The approach automatically allowed a continuous and efficient testing of the product.

With the team ramped up with a test automation specialist, the development process continued for another 2 years under agile methodologies. The CMS evolved into an easy-to-use and scalable platform that brings in a lot of features to improve user experience significantly:

• Responsive admin UI: it is a single dynamic page that allows users to manage one or dozens of websites simultaneously. No reloading is needed to navigate between documents and applications easily
• Real-time updates: thanks to WebSockets, users can always stay updated on any content modifications made by other users
• Live editing: now it is possible to build and edit layout templates without using HTML code. The tool provides unlimited design options with drag-and-drop components
• Flexible permissioning: all users, be it individuals or groups, can enjoy a simple and secure access to the content

“We have been trying to make user experience as smooth as possible,” says The Team Lead Java Developer Engineer Glory “This application is a single access point which helps manage unlimited number of websites, so you can avoid hiring administrators and thus reduce maintenance costs considerably. Besides, no programming is required to publish new content.”

Results

In cooperation with The team of 6 specialists, the Customer has released a brand-new CMS called  eXperience Platform to provide the most intuitive and fastest way to create and manage websites, intranets, commerce and mobile solutions for public and private enterprises.

For Morten Øien Eriksen, CEO and co-founder, eXperience Platform has been the biggest undertaking in the history of the company. “The costs are estimated at NOK 50 million. Our goal is to be innovative in all areas of the application and not to follow the path of our competitors. And now we have a platform with a modern and flexible architecture which is years ahead of our competition”, he says.

Throughout 5 years, Our cooperation with the Client has grown into a strategic and friendly relationship. “Working collectively  has enabled us to deliver the project faster and with better quality. Their developers are highly skilled and passionate about the project,” says Morten.

Technologies and Tools

Languages: Java, JavaScript, TypeScript, HTML, CSS

Frameworks & libraries: Vaadin, Ext JS, Gradle, Elasticsearch, Less

Customer

The Customer is a US multi-business enterprise operating in a range of industries, such as fashion retail, hospitality, and restaurant.

Challenge

The Customer had an IT infrastructure consisting of more than 50 servers with a range of integrated systems: an ecommerce website, CRM, a data warehouse, and others.

The number of the Customer’s clients was rapidly increasing together with their needs, so the Customer needed to frequently update their applications to keep their clients satisfied. To meet these and other business needs, the Customer needed their IT infrastructure properly managed, regularly enhanced without critical operational errors and system failures, and continuously monitored to make sure their web services were highly available.

Solution

To solve the Customer’s infrastructure management tasks, we assigned a team of DevOps practitioners with the expertise in system administration and software development. By combining the development (Dev) and operations (Ops) specialists’ efforts, our team aimed at significantly accelerating the delivery of new software features, fixes, and updates in alignment with the Customer’s business objectives.

The Customer’s IT infrastructure included three key elements integrated with each other: an eCommerce website, CRM, and data warehouse. To ensure the faultless performance of the integrated systems, Our Team set up and managed the tools for load balancing, infrastructure monitoring and log management. To manage the Customer’s eCommerce website, Our DevOps practitioners implemented the continuous integration and continuous delivery (CI/CD) pipeline.

CI/CD pipeline implementation

Using Stash as a source code repository and Jenkins as a CI/CD automation tool, DevOps engineers designed a CI/CD pipeline to accelerate the processes of developing, testing and releasing the updates and bug fixes for the Customer’s web applications based on Pimcore, Magento, Akeneo, etc. Our team applied Docker to containerize the Customer’s web applications and used the Distributed Cloud Operating System (DC/OS) based on the Apache Mesos distributed systems kernel to manage the containers. With the use of Ansible, Our team managed applications configurations.

With CI/CD pipeline implementation, Our DevOps practitioners aligned the development, test and stage environments with the production environment to eliminate the differences between them, and automated performance testing of web applications.

Load balancing and HTTP caching

For proper load balancing, network traffic distribution and HTTP caching across the Customer’s IT infrastructure, Our DevOps engineers used the following tools:

• Nginx – as a web server processing users’ requests.
• Traefik – as a load balancer responding to users’ requests and directing them to the right resource.
• HAProxy – as a load balancer distributing the requests across the Customer’s multiple servers while ensuring their high availability.
• Varnish – as an HTTP reverse proxy cache accelerating web servers’ response to the users’ requests of the Customer’s clients.

IT infrastructure monitoring and log management

To monitor disk usage, RAM and CPU consumption, DevOps engineers set up and applied Zabbix. Our team used Blackbox Exporter to monitor web services availability. To collect the data on web services availability from Blackbox Exporter and send alert notifications on the web services issues, Our DevOps engineers used Prometheus. For constant container performance monitoring, Our DevOps engineers applied Container Advisor.

For convenient web application log management, Our team applied the ELK stack: Logstash (L) parsed web application logs, sent them to Elasticsearch (E) where the logs were collected and filtered, and Kibana (K) worked as a visualization tool allowing for using the data stored in Elasticsearch to build charts and graphs with analytics results.

Results

With the DevOps practices that we introduced and applied, the Customer got the proper management of their IT infrastructure and benefited from the high availability of the IT infrastructure. As a result of Our DevOps engineers’ work, the Customer got the possibility to enhance the ecommerce solution frequently without disruptions to the business process.

Technologies and Tools

Source code repository: Stash.

Continuous deployment: Jenkins.

Configuration management: Ansible.

Containerization and container management: Docker, Distributed Cloud Operating System (DC/OS), Apache Mesos.

Load balancers and HTTP caches: Nginx, HAProxy, Traefik, Supervisor, Varnish.

Server monitoring: Zabbix, Prometheus, Blackbox Exporter, Container Advisor.

Log management: Elasticsearch, Logstash, Kibana (ELK).

Customer

The Customer is a large Asian retail bank with around 550 branches, providing comprehensive banking services to more than 2.5 million clients.

Challenge

The Customer needed to test the security controls deployed within their IT infrastructure. For this reason, they were looking for a qualified security testing provider knowledgeable in the banking industry to conduct:

• Vulnerability assessment and penetration testing of the network’s external perimeter.
• Vulnerability assessment and penetration testing of the network’s internal environment (servers, firewalls, etc.).
• Security risk assessment of the client digital channels (internet banking, mobile banking, mPOS merchant service, QR code payments, clients’ payments, and communication in social networks).
• Simulation of social engineering attacks at the employees’ emails to check their susceptibility to phishing.

Solution

The team of certified cybersecurity specialists carried out the following scope of security testing services:

• Vulnerability assessment and penetration testing of 60 external IP addresses.
• Internal network vulnerability assessment and penetration testing.
• Security risk assessment of the client digital channels (internet banking, mobile banking, mPOS merchant service, QR code payments, clients’ payments, and communication in social networks).
• Simulation of social engineering attacks.

Vulnerability assessment and penetration testing of the network’s external perimeter

Our team conducted black box penetration testing of the external perimeter of the Customer’s network. The ethical hackers didn’t manage to penetrate the network with no credentials, so they proceeded with the grey box testing method using user login details but having no access to the entire network. Grey box penetration testing revealed a vulnerability of the Customer’s remote server to external manipulations. We recommended the Customer address the vendor of server software to fix the issue.

Among other recommendations was eliminating the leakage of internal IP addresses from the DNS server to web pages visible to the Customer’s clients.

Vulnerability assessment and penetration testing of the internal network

Our security engineers scanned the Customer’s internal network for vulnerabilities and exploited the discovered vulnerabilities using the grey box penetration testing method. They discovered a server using the obsolete HTTPS protocol, which was critical for the banking environment storing clients’ data.

Moreover, our experts executed a remote command on the Customer’s firewall configured by a third-party vendor and could read the files of all network groups. Such a vulnerability could allow potential intruders to obtain user privileges and take over the Customer’s server. Our recommendations on remediation of the internal network issues included:

• Updating the HTTPS protocol.
• Updating or changing firewall software.

Security risk assessment of the client digital channels

Our team analyzed potential security risks of the following client digital channels: internet banking, mobile banking, mPOS merchant service, QR code payments, clients’ payments, and communication in social networks. The team revealed several risks in the payment and communication service used by the Customer’s clients:

• Initiating malicious operations (e.g., fund transfers) with clients’ contacts.
• Initiating malicious communications with the clients’ contacts (including contacts in social networks).

Our recommended treatment actions included:

• Adding functionality to authenticate users of the payment and communication service to prevent malicious communications.
• Adding functionality to confirm payments and other fund transfers.

Social engineering simulation

Our security specialists simulated phishing attacks at the bank employees’ emails. The ethical hackers managed to convince 65% of targeted employees to send personal data via email, which could potentially allow intruders to take over user credentials.

We recommended that the Customer hold social engineering and email phishing training sessions for employees and share knowledge about current cybersecurity threats.

Results

The Customer received detailed reports of the conducted network vulnerability assessment, penetration testing, and the security risk assessment of the client digital channels with recommendations to mitigate the discovered vulnerabilities. After fixing all the issues according to the provided remediation plan, the Customer ran retesting, which showed the increased security level of the network’s external perimeter and internal environment.

As the next step, the Customer plans to commission The team to perform cyber-compromise assessment to detect the potential threat actors and red teaming services to test the detection and response capabilities to real hacker attacks.

Technologies and Tools

Nmap, Nessus, Burp Suite, Gophish, Metasploit, Netcat, DIRB, Nikto, SSLScan, Firefox Developer Tools