When an audit is worth doing
An audit is useful at the moments when an expensive decision is coming and you need an objective basis for it.
- You are taking an application over from another team and want to know what you are buying
- A large investment into an existing platform is about to start
- You have had a security incident or suspect unauthorised access
- You are acquiring a company and want a technical assessment of its product
- You want to know why development has become slower and slower
What we examine
The audit covers both the security side and the side that determines what development will cost you from here on.
- Authentication, sessions, permissions and data separation between users
- Common vulnerabilities: database injection, code execution from user input, file uploads, form protection
- How passwords and sensitive data are stored
- Dependencies on vulnerable or unsupported versions
- The structure of the code and the areas where any change becomes risky
- The database: consistency, indexes, queries that will become problems at volume
- Backups, and whether they can actually be restored
What you receive at the end
A document a non-technical person in management can read, with a detailed technical section for whoever will carry out the repairs.
The findings are ordered by real risk rather than by how dramatic they sound, and each one carries an effort estimate. The document is yours and you can take it to any team, including one other than ours.