{"id":252229,"date":"2025-05-14T23:09:45","date_gmt":"2025-05-14T21:09:45","guid":{"rendered":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance"},"modified":"2025-05-14T23:09:45","modified_gmt":"2025-05-14T21:09:45","slug":"public-procurement-office-e-zamowienia-platform-security-and-performance","status":"publish","type":"project","link":"https:\/\/cyberforces.com\/en\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance","title":{"rendered":"Public Procurement Office E-Zam\u00f3wienia platform &#8211; security and performance"},"content":{"rendered":"<h2>About the project:<\/h2>\n<p>The goal of the project was to carry out, as an independent external auditor, specialized security and performance tests of the e-Zam\u00f3wienia Platform. The contractor of the platform was Pentacomp Systemy Informatyczne S.A., the Contract Engineer: SOFTIQ Sp. z o. o.<\/p>\n<p>The newly created platform supports the implementation of the public procurement process. It enables electronic communication between ordering parties and contractors. Registration on the platform is mandatory if the ordering party wants to publish the procedure plan and announcements in the Public Procurement Bulletin.<\/p>\n<p>The purpose of the Security Audit was to identify vulnerabilities that constitute or may pose a threat to processed, transmitted and stored information and data, and to assess the performance and availability of the platform,\u00a0as well as to identify potential single points of failure (SPOF). The assessment was based on performance and load tests.<\/p>\n<p>The audit was intended to demonstrate the independence and scalability of individual platform, services in the context of their possible development by independent contractors.<\/p>\n<h3>Challenge:<\/h3>\n<p><strong>The developed e-Zam\u00f3wienia Platform aims at supporting the process of digitalization of public procurement in three main areas:<\/strong><\/p>\n<ol>\n<li>Providing a tool enabling the use of electronic means in communication between ordering parties and contractors, in accordance with the Public Procurement Law,<br \/>in particular in the field of submitting offers, applications, declarations in public procurement proceedings and other documents,<\/li>\n<li>Issuing the Public Procurement Bulletin in electronic form, used to publish announcements on public procurement matters,<\/li>\n<li>Handling the obligation of contracting entities to submit annual reports on awarded contracts in electronic form.<\/li>\n<\/ol>\n<p>The platform consists of a number of functionalities that have been grouped into logical modules and components covering the following functional areas.<\/p>\n<h3>Modules:<\/h3>\n<ol>\n<li>\u00a0Identity Module (MT)<\/li>\n<li>Announcements Module (MO)\n<ul>\n<li>Preparation of announcements and proceedings plans<\/li>\n<li>Public Procurement Bulletin (BZP)<\/li>\n<\/ul>\n<\/li>\n<li>Proceedings Module (MP)\n<ul>\n<li>Initiation of proceedings, updating of the proceedings status<\/li>\n<li>Communication from stakeholders of the proceedings (questions\/answers, invitations, explanations, appeals, notices)<\/li>\n<\/ul>\n<\/li>\n<li>Module of Offers\/Applications (MOW)\n<ul>\n<li>Preparation and submission of offers\/applications\/competition entries<\/li>\n<li>Storing and securing offers\/applications\/competition entries<\/li>\n<li>Opening of offers\/applications\/competition entries<\/li>\n<\/ul>\n<\/li>\n<li>Monitoring and Analysis Module (MMiA)<\/li>\n<\/ol>\n<p>Components supporting the implementation of e-services:<\/p>\n<ul>\n<li>Central Data Repository (CRD)<\/li>\n<li>Communication Component (KOM)<\/li>\n<li>Mailing system (SM)<\/li>\n<li>Notification coordinator (KP)<\/li>\n<li>Cryptographic Component (KK)<\/li>\n<li>Key Master (ZK)<\/li>\n<li>Log Manager (ZL)<\/li>\n<li>API Manager (ZA)<\/li>\n<li>Developer Portal (PD)<\/li>\n<li>e-Sender<\/li>\n<li>Administrative Component (KA)<\/li>\n<li>Educational Component (KE)<\/li>\n<li>Notification Handling System (SOZ)<\/li>\n<li>Access portal (front-end WEB GUI)<\/li>\n<\/ul>\n<p>The Ordering Party provided TestArmy with the following documentation:<\/p>\n<ol>\n<li>Technical Design (PT),<\/li>\n<li>Technical and Post-Completion Documentation.<\/li>\n<\/ol>\n<h3>Process:<\/h3>\n<p>The security audit was carried out in 4 cycles, related to the increase in functionalities launched within the modules of the e-Zam\u00f3wienia Platform.<\/p>\n<p>The following phases of activities were carried out for each cycle:<\/p>\n<ol>\n<li>Phase 1 \u2013 Test Planning<\/li>\n<li>Phase 2 \u2013 analysis of the architecture in terms of security issues<\/li>\n<li>Phase 3 \u2013 Penetration, Performance and Load Testing<\/li>\n<li>Phase 4 \u2013 code review<\/li>\n<li>Phase 5 \u2013 preparation of the final report on the tests performed (Phases 2-4)<\/li>\n<li>Phase 6 \u2013 conducting re-tests after correcting critical errors identified in Phases 2 \u2013 4.<\/li>\n<\/ol>\n<p>We submitted working conclusions from the re-tests to the Ordering Party no later than on the day of completion of Phase 6, and the final report from the re-tests was provided by us within 1 business day since the testing of this Phase has been completed.<\/p>\n<h3>Results:<\/h3>\n<ol>\n<li>A review of the source code of the e-Zam\u00f3wienia Platform was carried out in terms of security issues (with particular emphasis on the correctness of validation of data sent to the Platform).<\/li>\n<li>Maps of the tested Platform were built independently, taking into account the number and type of network and server devices and the version of the services provided, according to Gray-Box test model.<\/li>\n<li>The vulnerabilities of the network, server and application infrastructure used were examined both from outside and inside the network.<\/li>\n<li>Appropriately selected attacks were carried out on the network, server and application infrastructure in the scope of:\u2013 Conducting security tests of the Platform by trying to break security from outside and inside the network, using methods currently used by \u201ccybercriminals\u201d, including backdoring, brute-force, breaking PSK keys, unraveling SSL\/TLS transmissions, and others based on the Contractor\u2019s experience.\n<ul>\n<li>Web application tests based on the OWASP (Open Web Applications Security Project) standard, in particular the OWASP Top 10 classification, as well as on the basis of the Contractor\u2019s experience.<\/li>\n<li>Platform security tests were carried out by attempting unauthorized access to resources, attempting unauthorized access to web applications [taking into account OWASP], attempting unauthorized access to servers, attempting unauthorized access to the network infrastructure, attempting unauthorized access to data, including modifying them.<\/li>\n<li>Conducted security tests for business logic errors. All GUI forms and all REST API services of the Platform are to be tested.<\/li>\n<li>Security tests of the e-Zam\u00f3wienia Platform were carried out according to the security test plan and scenarios prepared by the Contractor, at the level of an unlogged and logged in user, including the escalation of privileges by using functionalities outside a given role (functionalities dedicated to other roles). The Ordering Party will provide 2 test user accounts from each user class, for a total of 6 accounts. All GUI forms and all REST API services of the Platform are to be tested.<\/li>\n<\/ul>\n<\/li>\n<li>Verification of the configuration and parameterization of the Platform infrastructure was carried out, with the assistance of the Platform Contractor, in order to identify vulnerabilities and errors, including an analysis of the configuration of database servers and web servers, the configuration of individual devices should be carried out for all devices (even if they have a similar configuration ).<\/li>\n<li>Performance tests of the e-Zam\u00f3wienia Platform were carried out according to the prepared plan and scenarios aimed at examining the actual performance of the Platform\u2019s modules and components in the tested configuration and assessing the lack of resource leaks.<\/li>\n<li>Load tests of the e-Zam\u00f3wienia Platform were carried out according to the prepared plan and scenarios in order to determine the load boundary conditions for which the Platform no longer meets the assumed requirements for responsiveness and availability, and to conduct a scalability analysis.<\/li>\n<li>Conducting tests to identify potential single points of failure (SPOF).<\/li>\n<li>The impact of the developed operational procedures on the security of the Platform was verified.<\/li>\n<\/ol>\n<p>A summary of the tests performed, a review of the source code of the e-Zam\u00f3wienia Platform and a review of operational documentation in the form of a detailed report on the tests performed, detailing the tools and techniques used, was prepared in accordance with the classification of errors for all vulnerabilities and additionally for web applications according to the guidelines of OWASP standards.<\/p>\n<p>The e-Zam\u00f3wienia platform allows for the digitalization of the public procurement process. This would not be possible without ensuring adequate system performance and security. Projects like this demonstrate a responsible approach to building the state\u2019s digital infrastructure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>About the project: The goal of the project was to carry out, as an independent external auditor, specialized security and performance tests of the e-Zam\u00f3wienia Platform. The contractor of the platform was Pentacomp Systemy Informatyczne S.A., the Contract Engineer: SOFTIQ Sp. z o. o. The newly created platform supports the implementation of the public procurement [&hellip;]<\/p>\n","protected":false},"author":28,"featured_media":251882,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"project_category":[117],"project_tag":[],"class_list":["post-252229","project","type-project","status-publish","has-post-thumbnail","hentry","project_category-testy"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Public Procurement Office E-Zam\u00f3wienia platform - security and performance - CyberForces<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Public Procurement Office E-Zam\u00f3wienia platform - security and performance - CyberForces\" \/>\n<meta property=\"og:description\" content=\"About the project: The goal of the project was to carry out, as an independent external auditor, specialized security and performance tests of the e-Zam\u00f3wienia Platform. The contractor of the platform was Pentacomp Systemy Informatyczne S.A., the Contract Engineer: SOFTIQ Sp. z o. o. The newly created platform supports the implementation of the public procurement [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance\" \/>\n<meta property=\"og:site_name\" content=\"CyberForces\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/TestArmyCyberForces\/\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance\",\"url\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance\",\"name\":\"Public Procurement Office E-Zam\u00f3wienia platform - security and performance - CyberForces\",\"isPartOf\":{\"@id\":\"https:\/\/cyberforces.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/case-study-e-zamowienia-EN-1200x675-1.webp?wsr\",\"datePublished\":\"2025-05-14T21:09:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#primaryimage\",\"url\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/case-study-e-zamowienia-EN-1200x675-1.webp?wsr\",\"contentUrl\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/case-study-e-zamowienia-EN-1200x675-1.webp?wsr\",\"width\":1200,\"height\":675},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Strona g\u0142\u00f3wna\",\"item\":\"https:\/\/cyberforces.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Projects\",\"item\":\"https:\/\/cyberforces.com\/project\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Public Procurement Office E-Zam\u00f3wienia platform &#8211; security and performance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cyberforces.com\/#website\",\"url\":\"https:\/\/cyberforces.com\/\",\"name\":\"CyberForces\",\"description\":\"Testy bezpiecze\u0144stwa z TestArmy CyberForces. Testy penetracyjne, hackowanie aplikacji webowych i mobilnych, testy socjotechniczne. Dowiedz si\u0119 wi\u0119cej!\",\"publisher\":{\"@id\":\"https:\/\/cyberforces.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cyberforces.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/cyberforces.com\/#organization\",\"name\":\"TestArmy Group S. A.\",\"url\":\"https:\/\/cyberforces.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png\",\"contentUrl\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png\",\"width\":1210,\"height\":173,\"caption\":\"TestArmy Group S. A.\"},\"image\":{\"@id\":\"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/TestArmyCyberForces\/\",\"https:\/\/www.linkedin.com\/company\/cyberforcescom\/\",\"https:\/\/www.instagram.com\/cyberforces__\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Public Procurement Office E-Zam\u00f3wienia platform - security and performance - CyberForces","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance","og_locale":"en_US","og_type":"article","og_title":"Public Procurement Office E-Zam\u00f3wienia platform - security and performance - CyberForces","og_description":"About the project: The goal of the project was to carry out, as an independent external auditor, specialized security and performance tests of the e-Zam\u00f3wienia Platform. The contractor of the platform was Pentacomp Systemy Informatyczne S.A., the Contract Engineer: SOFTIQ Sp. z o. o. The newly created platform supports the implementation of the public procurement [&hellip;]","og_url":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance","og_site_name":"CyberForces","article_publisher":"https:\/\/www.facebook.com\/TestArmyCyberForces\/","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance","url":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance","name":"Public Procurement Office E-Zam\u00f3wienia platform - security and performance - CyberForces","isPartOf":{"@id":"https:\/\/cyberforces.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#primaryimage"},"image":{"@id":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#primaryimage"},"thumbnailUrl":"https:\/\/cyberforces.com\/wp-content\/uploads\/case-study-e-zamowienia-EN-1200x675-1.webp?wsr","datePublished":"2025-05-14T21:09:45+00:00","breadcrumb":{"@id":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#primaryimage","url":"https:\/\/cyberforces.com\/wp-content\/uploads\/case-study-e-zamowienia-EN-1200x675-1.webp?wsr","contentUrl":"https:\/\/cyberforces.com\/wp-content\/uploads\/case-study-e-zamowienia-EN-1200x675-1.webp?wsr","width":1200,"height":675},{"@type":"BreadcrumbList","@id":"https:\/\/cyberforces.com\/project\/public-procurement-office-e-zamowienia-platform-security-and-performance#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Strona g\u0142\u00f3wna","item":"https:\/\/cyberforces.com\/"},{"@type":"ListItem","position":2,"name":"Projects","item":"https:\/\/cyberforces.com\/project"},{"@type":"ListItem","position":3,"name":"Public Procurement Office E-Zam\u00f3wienia platform &#8211; security and performance"}]},{"@type":"WebSite","@id":"https:\/\/cyberforces.com\/#website","url":"https:\/\/cyberforces.com\/","name":"CyberForces","description":"Testy bezpiecze\u0144stwa z TestArmy CyberForces. Testy penetracyjne, hackowanie aplikacji webowych i mobilnych, testy socjotechniczne. Dowiedz si\u0119 wi\u0119cej!","publisher":{"@id":"https:\/\/cyberforces.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cyberforces.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cyberforces.com\/#organization","name":"TestArmy Group S. A.","url":"https:\/\/cyberforces.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/","url":"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png","contentUrl":"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png","width":1210,"height":173,"caption":"TestArmy Group S. A."},"image":{"@id":"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/TestArmyCyberForces\/","https:\/\/www.linkedin.com\/company\/cyberforcescom\/","https:\/\/www.instagram.com\/cyberforces__"]}]}},"_links":{"self":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/project\/252229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/project"}],"about":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/types\/project"}],"author":[{"embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/comments?post=252229"}],"version-history":[{"count":0,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/project\/252229\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/media\/251882"}],"wp:attachment":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/media?parent=252229"}],"wp:term":[{"taxonomy":"project_category","embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/project_category?post=252229"},{"taxonomy":"project_tag","embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/project_tag?post=252229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}