Web Application Audit

Make a web application audit part of your SLDC.

For app developers, a web application audit is the best way to ensure your app is secure before you release it and to prevent hacks, damage to reputation and significant losses to your bottom line.

The news today is full of stories of hot new apps that are hacked within days or weeks of their release. In many of these instances, a web application audit and adherence to application security best practices could have prevented these well-publicized security breaches.

The purpose of web application audit is to review an application’s codebase to determine whether the code is doing something it shouldn’t. Audits may also evaluate whether code can be manipulated to do something inappropriate and whether the apps may be communicating sensitive data in the clear. A superior web application audit should identify whether developers have implemented appropriate security precautions.

Typically, a web application audit will include “white box” automated testing that examines code from the inside, and “black box” testing that examines applications from the outside while in production.

A web application audit with Veracode

The key to a successful audit is in the breadth and quality of tools that are employed. That’s why, when seeking to protect applications from vulnerabilities and to secure compliance with regulation, more leading companies today turn to application security solutions from Veracode.

Veracode’s application security solutions and service help protect the software and web applications that are critical to a software-driven world. Veracode’s unified security platform enables organizations to confidently protect applications they build, buy and assemble, and to inject security in applications from design through production. With Veracode, you can easily ensure PCI DSS 6.5 and SOX compliance, and reduce the cost of delivering secure web and mobile applications.

Veracode’s web application audit tools

A web application audit with Veracode may include several steps:

Discovery of applications.

Many organizations have no idea how many applications they have, and therefore, no idea how many apps they must protect. Veracode’s Web Application Scanning solution creates a global inventory of all public-facing web applications, corporate sites, temporary marketing sites, international domains and sites obtained through merger and acquisition.

Finding vulnerabilities in apps that are running

Veracode uses a massively parallel infrastructure to test thousands of web application simultaneously with lightweight, non-authenticated dynamic scans. Veracode’s comprehensive deep scan capabilities can also help identify vulnerabilities using both authenticated and non-authenticated scans to search for cross-site scripting, .NET SQL injection, information leakage and other potential problems.

Identify problems prior to deployment

Veracode’s Virtual Scan Appliance performs a deep scan of applications located behind the firewall to find vulnerabilities in applications before launch.

Learn more about a web application audit with Veracode, and about Veracode solutions for performing an application control audit.