Whether you develop corporate applications internally, or purchase them from third parties, you’ll knowthat a single coding error can create a vulnerability exposing you to attacks resulting in considerable financial
or reputational damage. New vulnerabilities can also be generated during an application’s lifecycle, throughsoftware updates or insecure component configuration, or can arise through new attack methods.
Kaspersky’s Application Security Assessment Services uncover vulnerabilities in applications of any kind,from large cloud-based solutions, ERP systems, online banking and other specific business applications,to embedded and mobile applications on different platforms (iOS, Android and others).

Service Benefits

Kaspersky Application Security Assessment
Services help application owners anddevelopers to:• Avoid financial, operational and reputationalloss, by proactively detecting and fixing
the vulnerabilities used in attacks againstapplications• Save remediation costs by tracking down
vulnerabilities in applications still indevelopment and test, before they reachthe user environment where fixing them
may involve considerable disruption andexpense.
• Support a secure software development
lifecycle (S-SDLC) committed to creating
and maintaining secure applications.
• Comply with government, industry or internal
corporate standards covering application
security, such as PCI DSS or HIPAA

Combining practical knowledge and experience with international best practices, ourexperts detect security flaws which could expose your organization to threats including:••••

Syphoning off confidential data
Infiltrating and modifying data and systems
Initiating denial of service attacks
Undertaking fraudulent activities

Following our recommendations, vulnerabilities revealed in applications can be fixed,and such attacks prevented.

Service Scope and Options

Applications assessed can include official web sites and business applications,standard or cloud based, including embedded and mobile applications.
The services are tailored to your needs and application specifics, and may involve:• Black-box testing – emulating an external attacker• Grey-box testing – emulating legitimate users with a range of profiles• White-box testing – analysis with full access to the application, including source
codes; this approach is the most effective in terms of revealing numbers ofvulnerabilities• Application firewall effectiveness assessment – applications are tested withand without firewall protection enabled, to find vulnerabilities and verify whether
potential exploits are blockedResults

Vulnerabilities which may be identified byKaspersky Application Security Assessment
Services include:• Flaws in authentication and authorization,including multi-factor authentication• Code injection (SQL Injection, OSCommanding, etc.)• Logical vulnerabilities leading to fraud• Client-side vulnerabilities (Cross-SiteScripting, Cross-Site Request Forgery, etc.)• Use of weak cryptography• Vulnerabilities in client-server
communications• Insecure data storage or transferring, forinstance lack of PAN masking in payment
systems• Configuration flaws, including ones leading
to session attacks• Sensitive information disclosure• Other web application vulnerabilities
leading to the threats listed in WASC
Threat Classification v2.0 and the OWASPTop Ten.
Results are given in a final report including
detailed technical information on theassessment processes, results, vulnerabilities
revealed and recommendations forremediation, together with an executive
summary outlining management implications.
Videos and presentations for your technicalteam or top management can also be provided
if required.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com
2019 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are the propertyof their respective owners.

About Kaspersky’s Approach
to Application Security Assessment

Security assessments of applications are performed by Kaspersky security experts
both manually and through applying automated tools, with full regard of your systems’
confidentiality, integrity and availability and in strict adherence to international standards
and best practices, such as:••••Web Application Security Consortium (WASC) Threat Classification
Open Web Application Security Project (OWASP) Testing GuideOWASP Mobile Security Testing Guide
Other standards, depending on your organization’s business and location

Project team members are experienced professionals with a deep, current practicalknowledge of the field, including different platforms, programming languages,
frameworks, vulnerabilities and attack methods. They speak at leading international
conferences, and provide security advisory services to major vendors of applications
and cloud services, including Oracle, Google, Apple, Facebook and PayPal.

Delivery Options

Depending on a type of security assessment service, specifics of systems in the scope,and your requirements to work conditions, security assessment services can be provided
remotely or onsite. Most of these services can be performed remotely.

We are proven. We are independent. We aretransparent. We are committed to building a safer
world, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tommorow.
Know more at kaspersky.com/transparency