Secure Code review is the process of manually reviewing the source code that would highlight issues missed during a black box pentest. This review helps to detect the inconsistencies overlooked during all other security assessments.
Secure code review is a continuous improvement process that an organization goes through to identify and fix potentially risky vulnerabilities in the late stages of the development process. This could be due to poor secure coding practices by the developers responsible for writing the code. As the last threshold before an application moves to production / live environment, secure code reviews are an integral part of the security process. They serve as a sort of final "green tick" to assure you that the code is safe and that all dependencies and controls of the application are secured and functional.
We have a dedicated security assessments FAQ section. Read it here.
The assessment-execution phase is followed by the analysis & reporting. Defendza performs analysis on the testing output, evaluates the risk impact and likelihood of exploitation in realistic scenarios before providing action plans to remediate the identified risks. All our reports address business as well as the technical audience with supporting raw data, including mitigation measures at strategic and tactical levels.
The business logic for the entire application must be reviewed. This is only possible after gaining an understanding of how the application behaves for different privilege levels. From the threat-modelling phase and the knowledge gained, our consultants will be in the position to exploit business logic level vulnerabilities that are often overlooked by the developers
Our consultants would focus on the top 10 categories of attacks defined by the industry-standard OWASP. This includes:
Authentication and authorization problems are prevalent security vulnerabilities. Most mobile apps implement user authentication. Even though part of the authentication and state management logic is performed by the back end service, authentication is such an integral part of most mobile app architectures that understanding its common implementations is important.
Our reports are comprehensive and include all the evidence that supports our findings. We give you a risk rating that considers how likely an attack is as well as the impact it could have. We don’t create panic scenarios. Our mitigation is detailed, covering both strategic and tactical areas to help our clients prepare a remediation plan.
Apart from the range of commercial and open source tools available for specific testing, our team has its own custom scripts for efficient testing. We provide accurate results to make sure our clients completely understand any vulnerabilities we report.
Our teams are led by veteran security consultants accredited by CREST standards for the last several years. Our experience shows that our clients are best served by giving them the right advice for their cyber security needs. We do not believe in spreading fear, uncertainty and doubt to generate more business.
