Web Application Security Testing and
Vulnerability Assessments

Web application vulnerabilities are the leading threat to your company's online assets and data. Whether your website or web application has already been compromised, you wish to monitor activity, or you want to prevent malicous activity from happening, we can help. Our team is trained in both web application vulnerability analysis and remediating application vulnerabilities.

Web application vulnerabilities have become the leading threat to web assets and data from outside attacks on the Internet. The nature of web application vulnerabilities allow hackers to bypass firewalls and other network security controls to gain direct access to your web applications and sensitive data.

PCIS' Web Security Assessment (WSA) lowers the cost and risk of online business operations by identifying web vulnerabilities and prioritizing issues for immediate repair or security enhancements. Devfense WSA ensures the security of your web applications and is capable of providing necessary reporting for various regulatory requirements such as privacy legislation or credit card processing industry standards (PCI). WSA security analysis engagements are performed with experienced staff utilizing state of the art software (as cited by IDC and Gartner). Devfense WSA engagements tests for web application vulnerabilities such as those identified in the WASC (Web Application Security Consortium), OWASP (Open Web Application Security Project), and SANS (SysAdmin, Audit, Network, Security) Institute’s top 20 – including Cross Site scripting(XSS), SQL Injection, Session Riding, Privilege Escalation, Buffer Overflow, Incorrect Server Configurations, and more.

Web application security is a critical component in your company's overall IT security plan, consider:

• 75% of attacks are aimed at the application layer (Gartner)

Guard Your Corporate Assets

Web-based attacks can lead to loss of revenue, lower consumer confidence, devalue your corporate persona, as well as causing your web application to fail privacy or credit card compliance legislation. Proactively manage and prevent the risk of hackers stealing corporate or personal data, defacing your website, and impacting your IT infrastructure. Ensure your web applications are secure prior to public release by using a WSA engagement to confirm a new web application's security, or to test new features of an existing system. If you have engaged a developer to build a new web application for your firm, consider using a WSA engagement as a final requirement for sign-off on the project to ensure quality of the final deliverable has been met.

Gain Immediate Returns

Devfense WSA is performed by our web application security specialists allowing your staff to concentrate on other core business areas. Devfense WSA provides a comprehensive report of vulnerabilities and steps for remediation which allows your company the flexibility of having your resources act on the report or choose to engage our knowledgeable consultants.

Address Compliance Issues

Devfense WSA produces over 40 out-of-box compliance reports including Payment Card Industry Data Security Standard (PCI DSS), Payment Application Best Practices (PABP), Health Insurance Portability and Accountablity Act (HIPPA), and Gramm-Leach Bliley Act (GLBA) to easily address your auditing requirements.

Security in your Software Development Life Cycle

Automated assessments saves the development time of manually having to find vulnerabilities. Devfense WSA enables: developers to identify programming oversights that result in web security flaws and non-compliance; prioritization of issues; and recommendations for fixes. The cost of correcting vulnerabilities is less when performed during development than it is within a post-production environment, or even worse, after an attack.

Advanced Application Coverage

Devfense WSA provides complete vulnerability scanning of the latest technologies including enhanced support of Flash, JavaScript, AJAX , JSON, Web Services, Java, and applications that perform dynamic URL rewriting.

Network & Web Security

• Network Security Assessment
• Web Application Security
• Web Security Threats
• Identity Management