Our offer
Discover the breadth of our expertise. With years of experience in the IT industry, we deliver comprehensive software solutions to meet your unique needs.
IT systems require constant monitoring and should be subject to periodic security audits. Along with new technological solutions, new methods of breaking their security appear.
Web applications, due to their many advantages, are commonly used in numerous companies. For this reason, they are very often the target of various types of attacks. Lack of adequate security can result in data leaks, unauthorised actions or even the attacker taking complete control of the system.
We help identify vulnerabilities in web applications by conducting independent audits.
We address our offer to companies and organisations interested in verifying the security level of their web applications.
Why is a security audit important?
Security analysis is an essential part of any company’s overall information security strategy. This type of activity is useful for detecting threats and identifying vulnerabilities in software and processes.
Regular security audits are the basis for minimising the risks associated with attempts to break the security of web applications. Properly performed tests increase the likelihood of detecting potential software vulnerabilities. To achieve this, we use a wide range of tools and methods to find weak points.
Audits, vulnerability scans and penetration tests are used to analyse and assess how IT systems are secured and whether the protection still fulfills its function.
- Identification of previously unknown vulnerabilities.
- Testing new features.
- Demonstrate the real impact of vulnerabilities.
- Detection of authorisation and authentication issues.
- Compliance with regulations and standards.
- Evaluation of new security tools, processes, procedures and migration projects.
What is a security audit, and how is it carried out?
A security audit is an independent process of identifying threats and vulnerabilities in web applications. It involves a broad set of research techniques, including testing, a thorough analysis of the data obtained, and the preparation of a detailed report.
The methodology is based on the OWASP Application Security Verification Standard (ASVS) guidelines, with particular emphasis on the OWASP Top 10 recommendations. Tests are carried out using a variety of automated tools, as well as manual attempts to detect security vulnerabilities.
The audit’s result is a detailed report containing test results, vulnerabilities found, conclusions and recommendations.
What types of tests can be conducted?
Depending on your needs, a security level assessment may include different types of tests.
Vulnerability assessment
A vulnerability assessment helps identify and classify system vulnerabilities and provides guidance to eliminate or minimise them.
The purpose of performing a vulnerability assessment of a system is to detect as many potential security issues in an application as possible but without detailed information on how to exploit them.
A vulnerability is a weakness that can be exploited to gain unauthorised access or privileged control of an information system, application, service or server. Vulnerability management is the ongoing practice of identifying, prioritising and remediating vulnerabilities. Implementing vulnerability management is critical for organisations that want to improve their security posture and minimise the attack surface.
It is recommended to perform a web application vulnerability assessment at least quarterly, as it should be a proactive and systematic way of identifying new threats.
The security scan is performed using automated tools (such as dynamic analysis tools – DAST and fuzzing) in combination with manual system vulnerability testing, allowing for precise verification of false positives. The client receives a report with a detailed vulnerability assessment of the system, the results of the manual tests, and a description of the threats. Test results are categorised according to the risk rating of the vulnerability found.
Penetration testing
Our ethical hacking and security testing services identify and exploit vulnerabilities that can be missed during automated vulnerability assessments and provide clear help and advice to resolve issues.
Penetration testing is a form of cybersecurity assessment that aims to test the resistance of web applications to intrusions and cyber-attacks through comprehensive testing performed using appropriate standards: OWASP TOP 10 / OWASP ASVS / OWASP Testing Guide. They are used to verify current defence mechanisms and identify attack chains, i.e. possible ways of combining several security issues to achieve the intended goal.
Pen tests reproduce the conditions of an actual attack using the same tools and techniques cyber criminals use. The simulation of potential attacks on a web application aims at a realistic assessment of the security status of data of IT resources.
This type of research allows organisations to reduce application security risks by eliminating vulnerabilities and revealing existing threats before cybercriminals can exploit them. Threats are constantly evolving, so it is recommended that every organisation should order penetration testing at least once a year or more often when:
- The application has been extended with new features and services, or significant changes have been made to its code.
- The application has been integrated with external systems.
- Checking the application architecture.
- Analysis of the SSL/TLS encryption mechanisms according to the adopted security policies.
- Checking the version of individual services and their vulnerabilities.
- Checking the versions of frameworks, libraries and plug-ins for known vulnerabilities (e.g. Prototype Pollution).
- Brute force of administration panels and login forms.
- Verification of application requirements for authentication and authorisation.
- Verification of session and cookie security.
- Assessing vulnerability to SQL Injection, CSRF and XSS attacks.
- Verification of permissions and access to resources.
- Analysis of hidden content and potential for information leakage.
- Verification of error handling.
- Verification of password security.
- Verification of input data validation.
- Verification of API security.
Security audit
A security audit is a comprehensive assessment of an IT system that combines vulnerability assessment and advanced penetration testing. The audit is aimed at verifying the security of the IT system based on a checklist of industry best practices, externally established norms and standards.
The methodology of our work is based on the guidelines of the OWASP Application Security Verification Standard (ASVS), with particular emphasis on the recommendations of OWASP TOP 10. Tests are carried out using many different automated tools, as well as manual attempts to detect security vulnerabilities, such as:
- Vulnerability to SQL Injection, XSS, and CSRF attacks.
- Authentication vulnerabilities, including password security verification, credential recovery requirements, etc.
- Incorrect session management, including verification of time limits, session management mechanisms based on cookies and tokens, defence mechanisms against exploits, etc.
- Incorrect permissions and the possibility of unauthorized access.
- Security misconfigurations.
- Errors in database interaction.
- Problems with the validation of input data.
- Errors in application logic.
- Errors in encryption.
The result of the audit is a detailed report containing the results of the tests, finding the detected system vulnerabilities and their classification according to the ease of use and harmfulness to the system and the company, as well as conclusions and recommendations for eliminating the revealed security problems.
The audit’s detailed scope and the research method are adapted each time to the client’s needs. Together we determine what tests should be carried out and adjust the work scenario to the specifics of a given project.
What does the final audit assessment include?
Here is what the final assessment may include:
- A detailed description of all identified hazards.
- The potential business impact of each issue.
- Insight into the ease of exploiting vulnerabilities.
- Practical advice on countermeasures.
- Strategic safety recommendations.
Methodology of testing the security of web applications
Cybersecurity services can be carried out using black-box, white-box and grey-box tests:
- black-box - external tests simulating an actual attack, carried out without the knowledge of the application's internal mechanisms, without access to source code and server configuration information
- white-box - tests with full knowledge of the internal structure of the application and with access to source code.
- grey-box - an intermediate version between black-box and white-box, where only partial knowledge of the application in question is available.
What is a typical web application audit process?
1Identification of needs and type of audit
In the first step, we gather information about the client’s needs and the purpose of the application. On this basis, we make recommendations regarding the range and the type of tests and, together with the client, we determine the exact scope of the audit.
2 Planning
Before starting the project, we jointly analyse the collected information to define the scope of testing and develop an appropriate testing strategy, taking into account factors such as the purpose or scope of the audit. At this stage, we define the following:
- The technology stack, the scope of work and test objectives.
- The configuration of the target environment.
- Testing methodologies.
- Intrusion model and penetration testing methods.
3Development of audit methodology
Based on the information gathered, we prepare the audit methodology and plan the entire process in detail. Then we discuss the planned action scenarios and the implementation deadline with the client.
4Conducting the audit
During the attack phase, we focus on conducting a security assessment of the audited system. We carry out all work using accepted standards and methodologies, such as OWASP or PTES, and our know-how. Our work includes the following:
- Collecting data using external sources and specialised tools to obtain technical information about the sites and applications and to identify the services used.
- Identification of exploitable security vulnerabilities and errors in the configuration and management of the application.
- Advanced penetration testing.
5Report preparation
After the tests are completed, a document containing the key findings, interpretation of the received data, and recommendations for further actions is prepared.
