Kaspersky
Application SecurityAssessment

Whether you develop corporate applications internally, or purchase them from third parties, you’ll know thata single coding error can create a vulnerability exposing you to attacks resulting in considerable financial
or reputational damage. New vulnerabilities can also be generated during an application’s lifecycle, throughsoftware updates or insecure component configuration, or can arise through new attack methods.
Kaspersky Application Security Assessment Services uncover vulnerabilities in applications of any kind,from large cloud-based solutions, ERP systems, online banking and other specific business applications, toembedded and mobile applications on different platforms (iOS, Android and others).

Service Benefits

Combining practical knowledge and experience with international bestpractices, our experts detect security flaws which could expose yourorganization to threats including:Kaspersky Application Security
Assessment Services help
application owners anddevelopers to:• Avoid financial, operationaland reputational loss, by
proactively detecting andfixing the vulnerabilities
used in attacks against
applications• Save remediation costs bytracking down vulnerabilitiesin applications still indevelopment and test,
before they reach theuser environment wherefixing them may involve
considerable disruption andexpense• Support a secure softwaredevelopment lifecycle(S-SDLC) committed tocreating and maintaining
secure applications

Syphoning off
confidential data

Infiltrating and modifying
data and systems

Initiating denialof service attacks

Undertaking fraudulent
activities

Following our recommendations, vulnerabilities revealed in applications can befixed, and such attacks prevented.

Service Scope and Options
Applications assessed can include official web sites and business applications,standard or cloud based, including embedded and mobile applications.
The services are tailored to your needs and application specifics, and mayinvolve:•Black-box testing – emulating an external attacker•

Grey-box testing – emulating legitimate users with a range of profiles
and analysis of application business logic•

White-box testing – analysis with full access to the application, including
source codes; this approach is the most effective in terms of revealing
numbers of vulnerabilities•

If Web Application Firewall (WAF) systems are used for applicationprotection, they can be switched to monitoring mode or activated andrespond to attacks (in this case, the work is performed in two stages: withprotection disabled and in active mode to verify the identified findings).

About Kaspersky’s Approach to
Application Security Assessment
Results
Vulnerabilities which may
be identified by Kaspersky
Application Security
Assessment Services include:

Security assessments of applications are performed by Kaspersky security
experts both manually and through applying automated tools, with full regard of
your systems’ confidentiality, integrity and availability and in strict adherence tointernational standards and best practices, such as:•Web Application Security Consortium (WASC) Threat Classification•

OWASP Web Security Testing Guide•OWASP Mobile Security Testing Guide• Code injection (SQL Injection,OS Commanding, etc.)•

Other standards, depending on your organization’s business and location• Logical vulnerabilities leadingto fraud

Project team members are experienced professionals with a deep, current
practical knowledge of the field, including different platforms, programming
languages, frameworks, vulnerabilities and attack methods. They speak atleading international conferences, and provide security advisory services tomajor vendors of applications and cloud services, including Oracle, Google,Apple, Facebook and PayPal.

• Flaws in authentication andauthorization, including multifactor authentication• Client-side vulnerabilities(Cross-Site Scripting, CrossSite Request Forgery, etc.)• Use of weak cryptography• Vulnerabilities in client-server
communications• Insecure data storage ortransferring, for instance lackof PAN masking in payment
systems• Configuration flaws, includingones leading to session
attacks

Delivery Options
Depending on the type of security assessment service, the specifics of thesystems in scope, and your requirements for working conditions, security
assessment services may be provided remotely.

• Sensitive information
disclosure• Other web application
vulnerabilities leading to thethreats listed in WASC Threat
Classification v2.0 and theOWASP Top Ten.
Results are given in a final
report including detailed
technical information on
the assessment processes,results, vulnerabilities revealed
and recommendations forremediation, together with an
executive summary outlining
management implications.
Videos and presentations
for your technical team or
top management can also be
provided if required.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com© 2024 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture