Application Security/Web Application Security/Application Penetration Testing

Scope of Application Security

Traditional web applications

Mobile Applications

With ever increasing need for business to open its doors to business, web application is perhaps the first face that an organisation has. This first face is also perhaps the first place to get attracted and attacked in our internet world. With ease of availability of tools and resources, and absence of secure development processes, the need for protecting you web applications is even higher than ever before. The process applies to both traditional web applications as well as mobile application security.

Best Practice Frameworks

OWASP Top 10 (2010)

A1 – Injection

A2 – Cross site scripting (XSS)

A3 - Broken Authentication and Session Management

A4 - Insecure Direct Object Reference

A5 –Cross-Site Request Forgery (CSRF)

A6 –Security Misconfiguration(NEW)

A7 –Insecure Cryptographic Storage

A8 –Failure to Restrict URL Access

A9 –Insufficient Transport Layer Protection

A10 –Unvalidated Redirects and Forwards

How Coral can help?

Coral shall conduct security audit using the best practice methodology as per Open Web application security project (OWASP). The audit shall consist of the following range of assessment.

Process Review – involves verification of security in the design and architecture of the software development;
Black Box testing – performed mainly through tools is aimed at identification of vulnerabilities through known vulnerabilities resources.
White box testing – a much more detail analysis combining tools and analyst risk assessment approach looks for hidden vulnerability areas of the application which may not be visible through tools
Code Review – line by line review (and most expensive) involves verification of functionality and security controls.

Despite all development environmental vulnerability databases available, the most intriguing part remains the ability to assess the application business logic as coded by the developer. The amount of time and effort that exists with the developer is no match with the amount of time the security assessor has, and therefore remains the most intriguing part of the application security assessment.

Application Security/Web Application Security/Application Penetration Testing

Scope of Application Security

Best Practice Frameworks

How Coral can help?

Consulting Services

Consulting Services

Training Services

Knowledge Center

Industry Supported

Why Coral eSecure?

Products

Contact Us