Evaluate the security of your application through code auditing
The purpose of code auditing is to look for vulnerabilities in the source code of an application.
These vulnerabilities can be of several types: design errors or development errors.
Design problems can result from session management issues in web applications, allowing an attacker to hijack a user’s session or steal their identity.
Development problems can result from input processing flaws in web applications, allowing code execution at the database or server operating system level.
Through its code audit, ITrust analyzes how the application was designed and how the code was developed. The primary method is manual code review. By tracing data flows throughout the program, processing functions are evaluated to verify their alignment with the trust level of the processed input and output data.
Open-source static code analysis tools can be used to identify the most common flaws, such as buffer overflows, format strings, time-of-check/time-of-use issues, and more. In all cases, manual analysis is essential to eliminate false positives.
To ensure maximum coverage across various vulnerability types, ITrust relies on multiple frameworks, notably the following two:
- Secure Programming for Linux and Unix HOWTO: Creating Secure Software
- OWASP Top Ten Project
Whenever possible, flaw severity is assessed, ranging from "not exploitable" to "full server takeover" or "theft of confidential information".