Application security
The application, tested.
Offsecure tests web, mobile, desktop, and API applications before the weakness is used. The applications may sit on premises, in the cloud, or across both. The method is OWASP, applied to this build.
Application security testing is an evaluation of the software itself. It looks for the flaws an attacker would use, and it is how an organization shows the application meets the standards it is held to.
What is in scope
The test is shaped to the kind of application, and to where it is deployed.
Web applications
Injection, including SQL injection, cross-site scripting, and the rest of the flaws a browser-facing application collects.
APIs
Broken authentication, excessive data exposure, and the other weaknesses in the integration layer.
Desktop applications
Traditional software, and the flaws in it that an attacker can still reach.
Mobile applications
Insecure data storage and weak encryption, on iOS and Android, against the tighter standard a phone requires.
How the test is run
The same engagement can cover an application in development, in test, or in production.
- People. The team has spent years on application security, including web specialists and bug bounty hunters. Manual testing is combined with automated scanning, because a scanner misses what a person will try.
- Frameworks. Assessments follow OWASP and NIST. The structure is the framework. The target is this application.
- Fitted to the build. The approach follows the architecture, the deployment, and the threat profile of the application in front of the tester.
- After the finding. The testers stay with the team through remediation, so the fix is made and the same class of issue does not return.
OWASP Web Security Testing Guide
Web testing uses the OWASP Web Application Security Testing Guide as its base, and covers both static testing (SAST) and dynamic testing (DAST).
- Injection. SQL, NoSQL, and command injection.
- Authentication. Broken authentication, and the session that should have stopped it.
- Cross-site scripting. XSS against the application as it is actually used.
- Misconfiguration. Security misconfiguration, and the rest of the OWASP Top 10 that applies to this application.
OWASP Mobile Security Testing Guide
Mobile testing follows the OWASP Mobile Security Testing Guide, for iOS and Android.
- Data storage. What the application keeps on the device, and who else can read it.
- Sessions. Authentication and session management.
- Communication. Insecure channels between the app and the service behind it.
- Reverse engineering. What an attacker can recover from the application itself.
OWASP ASVS
Where the engagement is a verification against the Application Security Verification Standard, the level is agreed up front. The level follows the sensitivity of the application.
Level 1
For any application. Automated and basic controls, suited to a lower-risk app.
Level 2
For an application that handles sensitive data. Automated testing plus detailed manual verification.
Level 3
For the highest need, including financial and healthcare applications. Intensive manual verification of the advanced controls.
