<h3>Source Code Peer Review</h3>
<p>Gain access to our skilled personnel who can help you identify software defects before they lead to security vulnerabilities</p>
<h3>Source Code Automated Analysis</h3>
<ul class="list-style">
<li>Use automated tools and manual expert validation to discover software programming flaws before they lead to security vulnerabilities</li>
<li>Identify software design and programming flaws before they become security vulnerabilities</li>
<li>Rectify the flaws at design and development phases before they become too costly to fix in production</li>
</ul>
<h3>Source Code Peer Review</h3>
<ul class="list-style">
<li>Gain access to our skilled personnel who can help you identify software defects before they lead to security vulnerabilities</li>
<li>Correct defects early in the SDLC when problems are cheaper and easier to fix</li>
<li>Incorporate into your ISMS to meet compliance standards (PCI DSS 3.1 Requirement 6.3)</li>
</ul>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/application-security-testing.jpg" alt="" /></p>
<h3>Flag out common programming mal-practices</h3>
<ul class="list-style">
<li>All subroutines are commented in clear language.</li>
<li>Complex algorithms are explained and justified</li>
<li>Unit tests are added for new code paths or behaviors</li>
<li>Unit tests cover errors and invalid parameter cases</li>
<li>Possible null pointers always checked before use.</li>
<li>Etc., &hellip;</li>
</ul>
<h3>Leveraging OWASP Testing Framework</h3>
<div class="row">
<div class="col-md-4">
<ul class="nav nav-tabs tabs-left sideways">
<li class="active"><a href="#before" data-toggle="tab">Before development</a></li>
<li><a href="#definition" data-toggle="tab">Definition &amp; Design</a></li>
<li><a href="#development" data-toggle="tab">Development</a></li>
<li><a href="#deployment" data-toggle="tab">Deployment</a></li>
<li><a href="#maintenance" data-toggle="tab">Maintenance</a></li>
</ul>
</div>
<div class="col-md-8">
<div class="tab-content tab-content">
<div id="before" class="tab-pane active fade in">
<ul>
<li>Review SDLC Process</li>
<li>Policy Review</li>
<li>Standards Review</li>
</ul>
</div>
<div id="definition" class="tab-pane">
<ul>
<li>Requirements Review</li>
<li>Design &amp; Architecture Review</li>
<li>Create &amp; Review UML Models</li>
<li>Create &amp; Review Threat Models</li>
</ul>
</div>
<div id="development" class="tab-pane">
<ul>
<li>Code Review</li>
<li class="active">Code Walkthroughs</li>
<li>Unit &amp; System Tests</li>
</ul>
</div>
<div id="deployment" class="tab-pane">
<ul>
<li>Penetration Testing</li>
<li>Configuration Management Reviews</li>
<li>Unit &amp; System Tests</li>
<li>Acceptance Tests</li>
</ul>
</div>
<div id="maintenance" class="tab-pane">
<ul>
<li>Chance Verifications</li>
<li>Health Checks</li>
<li>Operational Management Reviews</li>
<li>Regression Tests</li>
</ul>
</div>
</div>
</div>
</div>
<h3>1. Set Objectives</h3>
<ul class="list-style">
<li>Understand application design and deployment scenario</li>
<li>Prioritize modules to review</li>
</ul>
<h3>2. Manual Analysis</h3>
<p>Deep-dive review of the following components:</p>
<ul class="list-style">
<li>User authentication and authorization</li>
<li>Data protection routines</li>
<li>Code that receives and handles data from untrusted sources</li>
<li>Data validation routines</li>
<li>Code involved in handling error conditions</li>
<li>Usage of operating system resources and networks</li>
<li>Low-level infrastructure code (e.g. memory I/O)</li>
<li>Embedded software components (e.g. open source libraries)</li>
<li>Usage of problematic/deprecated APIs</li>
</ul>
<h3>3. Review &amp; Rectify</h3>
<p>Review with developers to fix identified defects</p>
<h3>Source Code Automated Analysis</h3>
<ul class="list-style">
<li>Use automated tools and manual expert validation to discover software programming flaws before they lead to security vulnerabilities</li>
<li>Fix problems early in the SDLC when it is cheaper and easier to fix</li>
<li>Incorporate into your ISMS to meet compliance standards (PCI DSS 3.1 Requirement 6.3)</li>
</ul>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/application-security-testing-2.jpg" alt="" /></p>
<h3><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/application-security-testing-3.jpg" alt="" />Eliminate SANS Top 25 Most Dangerous Software Errors</h3>
<ul class="list-style">
<li>Missing Authentication for Critical Function</li>
<li>Use of Hard-coded Credentials</li>
<li>Reliance on Untrusted Inputs in a Security Decision</li>
<li>Missing Encryption of Sensitive Data</li>
<li>Use of a Broken or Risky Cryptographic Algorithm</li>
<li>Etc., &hellip;</li>
</ul>
<h3>Leveraging OWASP Testing Framework</h3>
<div class="row">
<div class="col-md-4">
<ul class="nav nav-tabs tabs-left sideways">
<li class="active"><a href="#before" data-toggle="tab">Before development</a></li>
<li><a href="#definition" data-toggle="tab">Definition &amp; Design</a></li>
<li><a href="#development" data-toggle="tab">Development</a></li>
<li><a href="#deployment" data-toggle="tab">Deployment</a></li>
<li><a href="#maintenance" data-toggle="tab">Maintenance</a></li>
</ul>
</div>
<div class="col-md-8">
<div class="tab-content tab-content">
<div id="before" class="tab-pane active fade in">
<ul>
<li>Review SDLC Process</li>
<li>Policy Review</li>
<li>Standards Review</li>
</ul>
</div>
<div id="definition" class="tab-pane">
<ul>
<li>Requirements Review</li>
<li>Design &amp; Architecture Review</li>
<li>Create &amp; Review UML Models</li>
<li>Create &amp; Review Threat Models</li>
</ul>
</div>
<div id="development" class="tab-pane">
<ul>
<li class="active">Code Review</li>
<li>Code Walkthroughs</li>
<li>Unit &amp; System Tests</li>
</ul>
</div>
<div id="deployment" class="tab-pane">
<ul>
<li>Penetration Testing</li>
<li>Configuration Management Reviews</li>
<li>Unit &amp; System Tests</li>
<li>Acceptance Tests</li>
</ul>
</div>
<div id="maintenance" class="tab-pane">
<ul>
<li>Chance Verifications</li>
<li>Health Checks</li>
<li>Operational Management Reviews</li>
<li>Regression Tests</li>
</ul>
</div>
</div>
</div>
</div>
<h3>1. Set Objectives</h3>
<ul class="list-style">
<li>Understand application design and deployment scenario</li>
<li>Proritize modules to scan</li>
</ul>
<h3>2. Automated Analysis</h3>
<ul class="list-style">
<li>Run automated scan on compilable codes</li>
<li>Tool will perform analysis such as data flow analysis, control flow analysis, taint analysis, and lexical analysis</li>
</ul>
<h3>3. Manual Verification</h3>
<p>Review of findings by expert to filter out false positives</p>
<h3>4. Review &amp; Rectify</h3>
<p>Review with developers to fix identified defects</p>
<p>{{brochure-pss-detail}}</p>