How to commission a software security assessment

Define the access questions to test

An application security assessment should help a business understand an exposure and decide what to change. Its value depends on what was examined, the evidence collected and whether somebody owns the response.

Before commissioning work, identify the application, the important information and the people entitled to use it. Use those details to write testable questions about how people can reach the information.

Read the source: OWASP: Application Security Verification Standard.

Define the questions the assessment will answer

Ask which versions, environments, interfaces and account roles are included. Decide whether the work covers design, configuration, source review, technical testing or several of these. A software security audit can mean different activities, so the deliverables need to be explicit.

The OWASP Application Security Verification Standard provides requirements for designing, developing and testing application controls. Ask a supplier to state the criteria and coverage used. Ask for results tied to the controls that were actually checked.

Test access across the actual business boundaries

For an illustrative customer portal, a signed-in customer should see only the information they are entitled to. Staff roles may differ, and a departed employee should lose access through the agreed process. Include tests that try to read or change another customer’s information after signing in.

Identity integration services connect an application to the system that manages its users. SSO implementation services let people use a shared sign-in arrangement. The business still needs to decide which people have which permissions and how those permissions change.

Agree checks for changes in employment, customer membership and role. Check permissions for each important action after login.

Authorize testing with a usable plan

Application penetration testing attempts to identify exploitable weaknesses within an agreed scope. Establish written authorization, permitted methods, test accounts, timing and a contact who can stop the activity. Those boundaries protect the business and help the tester produce usable evidence.

Ask how sensitive findings and test information will be handled. A public-facing production system and a safe test environment can require different arrangements. Confirm what the tester can attempt and what needs to be verified in a separate environment.

Buy findings that someone can act on

The report should explain the affected capability, the evidence, likely business consequence, proposed correction and uncertainty. Separate a confirmed weakness from an unverified tool alert. Agree who prioritizes the response and which corrections will be checked again.

Secure software development should incorporate the relevant lessons into future work. Repeat relevant checks when a release changes the affected controls.

Connect the assessment to ownership

Decide who can approve access changes, fund corrections and accept remaining risk. Include an agreed process for reviewing significant future releases or changes in the information the system holds.

AI App Studio can help scope a business application's access and security needs. Book a call with the system and the decision you need the assessment to support.