Result Summary

Vulnerabilities

OWASP Top 10

Evaluation Methodology

SecurityONE has used seCode review is systematic examination of computer source code and reviews are done in various forms and can be accomplished in various stages of each organization S-SDLC. This document does not attempt to tell each organization how to implement code reviews in their organization, but this section does go over in generic terms and methodology of doing code reviews from informal
walkthroughs, formal inspections, or Tool-assisted code reviews.

• Pre-Review Discovery
  A representative from the target application’s development team is asked to confirm the scope of the engagement. Trustwave requires a full list of the applications to be tested, design documentation, and third-party in-use, applications, and libraries used during the design, coding, and testing of the target application. This information allows the SecurityONE consultants to become familiar with the existing application environment prior to the commencement of the engagement.

• Documentation Review
  SecurityONE conducts a detailed review of the existing documentation for each application listed in this proposal, including design documents, concept of operations, and source code listings. On an as-needed basis, SecurityONE requests clarification on components of the site, functionality, program flow, and design issues.

• Architecture and Product Familiarization
  SecurityONE reviews the overall architecture of the application to become familiar with the security issues resulting from any third-party tools, applications, libraries, or services being used. This includes interface specifications for any pre-existing libraries or utilities, as well as security vulnerabilities or known issues with commercial tools and applications.

• Static and Manual Source Code Analysis
  The SecurityONE team performs a detailed, manual analysis of the application source code. Many of the vulnerabilities discovered in a source code review are like vulnerabilities discovered during an Application Penetration Test. Unlike a penetration test, a code review allows for a greater breadth of coverage and an increased confidence level in the results of the assessment. This is principally a result of having a fuller understanding of the design, software architecture and its internals, allowing identified vulnerabilities to have their exploitability fully assessed from a risk perspective.

Detailed Results

Remediation

All critical and high risk errors were fixed immedeatly ( ). Lower risk errors were adressed in the issue queue ( ). No instances in countries were affected.

Report