Service
What is a Source Code Audit?
Companies normally include small applications (Applets, CGIs, ActiveX, etc.) on their websites that help manage data submitted by users (personal data, orders, online payments, access control, etc.). There are also other companies that use their website to perform a wide variety of operations with their clients/suppliers/personnel (e.g., corporate portals, online brokers/banking, e-commerce, extranets, etc.), which involves the use of a complex application that runs on the web or application server and manages all these operations.
The process of auditing Applications is planned in the phases presented below:
Code
The programming language and its functionalities and particularities from a security perspective, given that the project's goal will be to define possible improvements to implement security best practices in that specific language.
Context
It is necessary to become familiar with the application to be reviewed. The security to be achieved will be defined by the business requirements of where the application is used, what data it handles, and what the consequences of illegitimate access to this information would be.
Audience
It may be advisable to have the collaboration of application users who can provide information about the audited application. Knowing how security controls have been implemented in critical and key aspects of it will allow for identifying where the most relevant deficiencies might be found.
Topology
Situation of the application and its components within the network context (in some cases, the review of these aspects will be omitted).
Importance
It is necessary to understand the availability requirement of the application and the effect of its loss on the business.
Our services
How we work
Our methodology allows us to carry out an exhaustive review of the audited applications, covering the following security aspects:
01Authentication
It is audited that all internal and external connections (users and entities) pass through an appropriate and adequate authentication system, and that these controls cannot be bypassed; all pages or areas of the application require proper authentication; POST is used at points where credentials or sensitive information are transmitted; credentials are transmitted encrypted; etc.
02Authorization
It is verified that appropriate authorization mechanisms have been implemented; user types or profiles and their respective rights have been clearly defined; the "least privilege" principle is applied; authorization is required for each request; etc.
03Cookie Management
It is verified that the cookies do not include sensitive information; that unauthorized actions cannot be performed by manipulating them; encryption is used and transmission is secure; session data is correctly validated, and the cookie maintains the minimum amount of information possible; etc.
04Input Data Validation
The audit verifies that robust data validation mechanisms exist and include all data that can be modified by a malicious user, such as HTTP headers, input fields, hidden fields, list data, cookies, and HTTP headers/data; that all data validation checks are performed on the server side and not the client side; that there are no backdoors in the validation model; etc.
05Error/Information Leakage Management
At this point, it is verified that all methods/functions that return values have proper error handling and return checked and expected values under error conditions. This includes managing exceptions and error situations; ensuring system errors are not returned to the user; and ensuring the application fails “safely,” etc.
06Log/Audit
It is audited that no sensitive information is stored in application logs: cookies, information in "GET" methods, authentication credentials, etc.; the application logs actions performed by users, especially in cases of potentially dangerous actions; all authentication events, whether failed or successful, are recorded; etc.
