Definition of Attacker Model
Attack Surface Analysis (ASA)
Technical Security Audit
Proof of Concept (PoC)
Security Audit Report
For our Web Security Audits, we use a well-defined auditing workflow:
Step 1 - Definition of Attacker Model and Audit Depth: Together with our customers, we define the audit depth, aggressiveness, specific customer requirements and types of attackers that should be considered during the security tests.
Step 2 - Attack Surface Analysis (ASA): In accordance with the defined attacker model, we analyze which parts of the web application can be reached by attackers (attack surface).
Step 3 - Technical Security Audit: This is the main part of the security audit. We typically use a combination of established automated and manual testing techniques to identify security vulnerabilities.
Step 4 - Proof of Concept (PoC): For identified security vulnerabilities, we develop Proof of Concept (PoC) exploits. The PoC exploits demonstrate the identified vulnerabilities, they ensure high reproducibility of our results and they can be utilized for testing purposes during development of subsequent security fixes.
Step 5 - Security Audit Report: In the final step, our customers receive a detailed report that includes a description of the conducted tests, the identified security flaws and suggested security fixes.
Want to know more ?
Our security testing methodology relies on the core principles of information security established web security standard such as OWASP.
Black-Box Security Audit/Penetration Test
In a Black-Box Security Audit, we do not have access to the website code running on the web server. You provide us with an URL and after we have received a written ’permission to attack’ from you, we can start to test the security of your website to identify vulnerabilities in a similar way an external attacker would do. To identify vulnerabilities, we leverage established automated and manual security analysis techniques.
Gray-Box Security Audit/Penetration Test
In contrast to a Black-Box Security Audit, in a Grey-Box Security Audit we also have access to the code running on the web server (e.g., a Tomcat or .NET application utilizing an SQL database), but access to source code is not available. The assumption is realistic if the web application is a commercial software product or it relies on existing frameworks such as a CMS system that can be obtained by external attackers as well. In addition to established automated and manual analysis techniques, we leverage powerful software security analysis techniques such as static and dynamic code analysis (e.g., decompilation and debugging) or reverse engineering to discover vulnerabilities in the web application code running on the web server. The result is a deep understanding of how security critical functions are handled within the web application.
White-Box Security Audit and Source Code Review
In a White-Box Security Audit, we have full access to the source code running on the web server (e.g., a web application utilizing a server-side scripting language such as PHP, ASP or Ruby). The
assumption is realistic if the web application leverages server-side scripting and is a commercial software product or it relies on existing frameworks such as a CMS system that can be obtained by external attackers as well. To discover vulnerabilities, we utilize the wide range of vulnerability analysis techniques available for Black-Box and Grey-Box security audits combined with server-side source code reviews.
Web Application Security Design & Architecture
Your web application needs a new security design, the old one didn’t withstand real-world attacks or the current one should be improved? We bring in our security expertise and experience to help you in developing a solid security design and architecture that fulfills your requirements. We are used to working together with development teams and we understand many of the typical challenges that need to be addressed in large scale web applications.
Forensics and Emergency Handling
Your web server has been compromised? In a first step, we take a forensic image of the web server to analyze the root cause of the break-in with the aim to assist you in patching the vulnerability and getting your web service back up online as fast as possible. In a second step, we analyze the forensics image and correlate log files from other sources to gather information on the actions that have been performed by the attacker. This way, the impact of the attack and the possible data leak can be assessed. The results are provided to you in a well-structured forensics audit report.