Vendor from the SecTec portfolio
SW Platforma GM
SW Platforma GM is listed in the portfolio as an enterprise agenda platform for grant management, agenda digitization, workflow, approvals, reporting, and process auditability.
Vendor Focus
SW Platforma GM supports digitization, records, workflow, and management of agendas that may include sensitive data, internal processes, and audit requirements.
For security-oriented content, SW Platforma GM is relevant where secure agenda management makes sense: GRC, policy management, audit & reporting, risk assessment, identity lifecycle, and data classification.
Solutions and Products
Grant Management
Digitization of grant schemes from calls and applications through evaluation, approval, delivery, and reporting.
Workflow and Approvals
Processes, states, tasks, evaluation, transparent decision-making, and agenda management.
Reporting and Audit
Dashboards, outputs, audit trail, and control over agenda status.
Integrations and Registers
Connection to internal data sources, registers, and existing information systems according to the project.
Secure Application Environment
Access control, roles, identity lifecycle, and data protection in the agenda platform.
Typical Use Cases
- a public or grant organization needs to digitize the full process
- processes must be auditable, transparent, and reportable
- the platform needs managed access, roles, states, and integrations
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
- Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
- BOPLA – Broken Object Property Level AuthorizationAn API exposes or allows modification of sensitive object properties that the user should not access, including excessive data exposure and mass assignment.
Relevant ATT&CK techniques
- T1005 · Data from Local SystemDetect, Prevent, Respond
- T1020 · Automated ExfiltrationDetect, Prevent, Respond
- T1041 · Exfiltration Over C2 ChannelDetect, Prevent, Respond
- T1048 · Exfiltration Over Alternative ProtocolDetect, Prevent, Respond
- T1069 · Permission Groups DiscoveryDetect, Prevent, Respond
- T1078 · Valid AccountsDetect, Prevent, Respond, Validate
- T1098 · Account ManipulationDetect, Prevent, Respond, Validate
- T1114 · Email CollectionDetect, Prevent, Respond
- T1133 · External Remote ServicesPrevent, Validate
- T1136 · Create AccountDetect, Prevent, Respond
- T1195 · Supply Chain CompromisePrevent, Validate
- T1213 · Data from Information RepositoriesDetect, Prevent, Respond
- T1484 · Domain or Tenant Policy ModificationDetect, Prevent, Respond, Validate
- T1530 · Data from Cloud StorageDetect, Prevent, Respond
- T1567 · Exfiltration Over Web ServiceDetect, Prevent, Respond
- T1685 · Disable or Modify ToolsValidate
- T1686 · Disable or Modify System FirewallValidate