Application Security

In a technological world where everything seems to be interconnected, use and management applications are predominant. The vulnerabilities present in these software are particularly dangerous as they can expose devices or services to risks of manipulation, data theft, or being a vector of malware or hackers.

The Abissi team, highly specialized in Application Security, offers services including (consultancy) support to the customer from the early stages of the Software Development Life Cycle (SDLC), to promptly identify and remedy any security problems. In this context, the cost for remediation is considerably lower than in more advanced stages.

The offer also includes the Security audit service of the source code (secure code review) of HW / SW products to identify potential vulnerabilities, all with a semi-automated approach using tools developed ad-hoc by Abissi and followed by a manual verification phase.

Then we arrive at the Penetration Testing services where, with the support of OWASP and proprietary methodologies, the software is tested, in the test or (preferably) production environment.

By software we mean the broadest meaning of the term. Our tests range from web applications to APIs, Android and iOS mobile applications up to the cloud and serverless technologies.

The security tests are more effective the more the environment to be tested is similar to the production environment. Tests on production environments tend to be more realistic and we always tend to recommend them. Our methodology, combined with highly specialized personnel, ensures that the tests do not degrade the quality of service of the systems under test.

The offer culminates in training that is tailored to the customer needs but usually covers topics such as secure development, how to integrate security into the SDLC, and an overview of the most common vulnerabilities affecting software.

At the end of the tests, our reports will contain any identified vulnerabilities, all contextualized to eliminate or minimize false positives, classified with a method derived from NIST 800-30, and for each detected vulnerability, the remediation activities will be detailed to mitigate the identified security issues.