FCS Software is a UK-based technology company specialising in software solutions for local government. Its portfolio encompasses platforms that support councils in managing planning processes and electoral administration, both of which operate within a multi-tenanted environment and process sensitive public sector data on behalf of their clients.

As FCS Software expanded its client base across local government, the sensitivity of the data its platforms handle and the level of trust placed in them by public sector clients made independent security validation an essential step. The company engaged CodeShield to conduct web application penetration tests across two of its core products.

FCS Software required a testing partner with demonstrable expertise in web application security and the ability to work closely and directly with its development team throughout each engagement. CodeShield’s approach, assigning a single dedicated tester to each project with no handoffs or intermediary layers, gave FCS Software confidence that both assessments would be thorough, consistent, and properly tailored to the architecture of the platforms under test.

The scoping process was efficient and collaborative. CodeShield worked directly with the FCS Software team to agree testing boundaries, define the access contexts to be assessed, and establish clear communication expectations from the outset. Rather than delivering findings in a single batch at the end of testing, CodeShield shared issues as they were identified, allowing the development team to begin remediation work in parallel and ensuring there were no surprises at the close of either engagement.

Both platforms serve multiple council authorities from a shared infrastructure, meaning that any security weakness carries the potential for impact across the entire client base. FCS Software needed each platform evaluated from multiple perspectives, including unauthenticated access and the full range of authenticated user roles, to ensure that access control boundaries were correctly enforced throughout and that no weaknesses existed at the application layer that were not reflected in the user interface.

Each platform presented its own distinct security considerations, shaped by the nature of the data it processes and the operational context in which it is used. Ensuring that both met the standard expected of public sector systems handling sensitive information was the central objective of the engagement.

Both assessments were conducted against dedicated test environments, with CodeShield maintaining close and direct communication with the FCS Software team throughout. Testing was performed across unauthenticated and authenticated phases for each platform, with authenticated testing conducted across all defined user roles to ensure that permission boundaries were correctly enforced and that no unintended access paths existed between them.

The approach of sharing findings in real time as testing progressed proved particularly valuable to the FCS Software team. Rather than receiving a consolidated list of issues at the end of an engagement, the development team was kept informed throughout, which accelerated the remediation process and allowed each final report to serve as a confirmation of work already underway rather than the starting point for it.

The assessments identified findings across both platforms spanning access control and authentication. Each issue was documented in the final reports with a clear description, an assessment of the business risk it presented, and prioritised remediation guidance structured to be actionable for the development team and accessible to non-technical stakeholders.

One platform demonstrated a particularly strong overall security posture, with core functionality found to be secure and access controls correctly implemented throughout. The other presented a number of findings that, whilst clearly remediable, required prompt attention. In both cases the quality of the remediation guidance enabled FCS Software to act quickly and confidently on the results.

Across both engagements, FCS Software gained the independent validation needed to present its platforms to public sector clients with confidence. The close working relationship with the CodeShield team throughout each project, and the clarity of the reporting, provided a standard of security assurance the company could stand behind.

TRUSTED UK PENETRATION TESTERS

At CodeShield, our UK penetration testing team brings 20+ years of combined expertise delivering practical, results-driven security solutions tailored to your business.

Get a FREE penetration test quote today