Security Code Review

Challenge

Because organizations are under pressure to bring applications online quickly, security often suffers as a result. Many of these applications store sensitive data that needs to be protected - especially when sharing information across networks, via extranets, and over the Internet. Inadequately secured applications can expose vital data, and security vulnerabilities from poorly designed or written code may enable attackers to gain access to confidential information, modify a database or other system, or cause the application to crash or become unstable.

Application source code security reviews are necessary not only because of the significant operational risk posed by vulnerable software, but also because they are mandated by the regulations and policies that govern data privacy, integrity, and good corporate governance. Regulations such as PCI, Sarbanes-Oxley and FISMA and control frameworks such as COBIT and COSO are driving application security and, more specifically, source code analysis activities to the forefront of business requirements and best practices.

Solution

Secure Application's Application Source Code Security Review consists of a line-by-line analysis of source code for normal and unexpected code behavior; this review enables our consultants to identify any code-level risks that could pose significant risk to your business applications. At the end of the review, our consultants report their technical findings and provide actionable mitigation steps to resolve code-specific issues such as inadequate storage of sensitive data, hard-coded passwords, unsafe string operations, logic bombs, backdoors, and many others.

Benefits

• Provides documented proof that your source code follows application security best practices
• Identifies security issues before cyber criminals can take advantage of them
• Ensures the integrity and security of information assets
• Increases user confidence that sensitive, business-critical data is protected

Secure Application's Application Security Assessment and Penetration Testing offering and our cafeteria menu provide the flexibility you need to customize our engagement to meet your security and budget requirements. Services include:

Experience with many languages and frameworks

• ASP.NET, VB.NET, C#, Classic ASP
• J2EE, Struts
• Java, JSP, JavaScript
• C/C++

Application security penetration testing

• Control flow analysis
• Authentication mechanism effectiveness
• Authorization and access control granularity
• Analysis of auditing techniques for non-repudiation
• Information disclosure
• Detection of vulnerable functions and procedures

Review of application code behavior in unexpected/uncommon situations

• Input validation
• Parameter manipulation
• Output encoding
• Unsafe failure analysis, verbose error messages
• Effective logging and auditing
• Denial of service