Application assessment is a unique area of assessment and penetration testing. Unlike infrastructure based application assessments, the methodology utilized by a security professional for identifying security vulnerabilities and significant issues is highly dependent upon the type of application being assessed. Although several high-level methodologies do exist and some guides can indeed be quite comprehensive, they are often not generic or versatile enough to cope with the wide variety of custom web applications commonly encountered. Many methodologies used by professional application security assessment organizations are in fact highly guarded.
Regardless of whether it is a web-enabled client-server application or an n-tier compiled application, the methodology actually implemented by the security consultant to assess the security of all client-side functionality will also be subject to the consultants own experience and skill set. Instead of focusing on an all-encompassing application security assessment methodology, many consultants may find it more practical to cycle through a check-list of questions. The emphasis of the questions is not so much on how you test the application, but more as to what the consultant should be looking for.
Whether constructing, enhancing, or simply maintaining a complex business system, it pays to monitor the level of Technical Quality being built in along the way. Technical Quality ensures a sound foundation for the application – helping you eliminate many risks to the business, related to system stability and security. An application that is well designed, structured and programmed is less risky to the business, less costly to maintain and faster to build upon. The notion of assessing Technical Quality is not new – many IT organizations conduct architectural and code reviews on their critical systems. The problem is that such reviews are hard to carry out, due to organizational and resourcing constraints, making it difficult for IT managers to proactively manage the foundational quality of their applications.
Regardless of whether it is a web-enabled client-server application or an n-tier compiled application, the methodology actually implemented by the security consultant to assess the security of all client-side functionality will also be subject to the consultants own experience and skill set. Instead of focusing on an all-encompassing application security assessment methodology, many consultants may find it more practical to cycle through a check-list of questions. The emphasis of the questions is not so much on how you test the application, but more as to what the consultant should be looking for.
Whether constructing, enhancing, or simply maintaining a complex business system, it pays to monitor the level of Technical Quality being built in along the way. Technical Quality ensures a sound foundation for the application – helping you eliminate many risks to the business, related to system stability and security. An application that is well designed, structured and programmed is less risky to the business, less costly to maintain and faster to build upon. The notion of assessing Technical Quality is not new – many IT organizations conduct architectural and code reviews on their critical systems. The problem is that such reviews are hard to carry out, due to organizational and resourcing constraints, making it difficult for IT managers to proactively manage the foundational quality of their applications.