50 lines
2.4 KiB
XML
50 lines
2.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section>
|
|
<title>Code Audit</title>
|
|
<p>
|
|
<company_short/> will perform a code audit to aid pentesting. During a
|
|
code audit, we manually examine the code of an application to ensure there
|
|
are no security vulnerabilities and use our understanding of the code to
|
|
guide our pentesting. If vulnerabilities are found, we document those and
|
|
suggest ways to fix them. This is done by highly-trained penetration testers
|
|
who can both review the raw code as well as interpret the findings of the
|
|
automated scans, putting them into context.
|
|
</p>
|
|
<p>
|
|
During the code audit portion of penetration tests, we take the following
|
|
criteria into account:
|
|
</p>
|
|
<ol>
|
|
<li>Risk Assessment and "Threat Modeling"<br/>
|
|
In this step, we analyze the risks of a particular application or system.
|
|
Threat Modeling is a specific, structured approach to risk analysis that
|
|
enables us to identify, qualify, and address the security risks, thus
|
|
dovetailing with the Code Review process. For example, user data is
|
|
sacred. We focus on encrypted storage, discover if <client_short/> employees
|
|
have a backdoor into data, and cut loose stolen devices by wiping them
|
|
remotely and revoking accounts.
|
|
</li>
|
|
<li>Purpose and Context<br/>
|
|
Here we focus on risks, especially in the quick and easy sharing of
|
|
internal documents and itineraries. Account details aren't so secret
|
|
when we know who will be in meetings, but what's being discussed is secret.
|
|
</li>
|
|
<li>Complexity<br/>
|
|
The complexity of the system is in the frameworks that support the web
|
|
application. We'd ignore those and focus only on the custom code and
|
|
backend code. We would also
|
|
focus on implementation mistakes and known flaws in the systems. For
|
|
example, we'd ensure you're using the latest versions of software,
|
|
but we wouldn't delve into the framework itself. Since we assume the
|
|
code is written by a team, it should be clearly-written code. If you have
|
|
several full-release versions, there will undoubtedly be several revisions
|
|
and audits on that code.
|
|
</li>
|
|
</ol>
|
|
<p>
|
|
For more information, please refer to this link:
|
|
<a href="https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents">
|
|
https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents</a>
|
|
</p>
|
|
</section>
|