Real-World Tactics, Techniques, and Procedures for Today’s Application Testing
For Application Security Testing, TrustedSec can analyze any type of web application regardless of the language it is written with.
TrustedSec uses the OWASP Testing Guide for its assessment methodology, and has created and developed solid methodologies for testing any type of application. TrustedSec’s web application testing relies on the use of real-world tactics, techniques, and procedures.
Testing ensures complete coverage of the OWASP Top 10 web application risk categories:
- A01:2021-Broken Access Control
- A02:2021-Cryptographic Failures
- A03:2021-Injection
- A04:2021-Insecure Design
- A05:2021-Security Misconfiguration
- A06:2021-Vulnerable and Outdated Components
- A07:2021-Identification and Authentication Failures
- A08:2021-Software and Data Integrity Failures
- A09:2021-Security Logging and Monitoring Failures
- A10:2021-Server-Side Request Forgery
Black-Box Testing
Automated web application scanning produces validated results to reduce false positives.
White-Box Testing
Manual and automated source code analysis of application code base determines the source of issues that could result in exploitation.
Grey-Box Testing
Credentials are manually utilized to gain access to the inner workings of the application.
Hybrid (White/Grey) Testing
White-Box Testing results are fed into a Grey-Box Test to reduce time and provide an actionable, prioritized list of issues.
Web Services & API Testing
Accessing the API services is based on building attack scenarios upon the endpoints provided. This includes both credentialed and uncredentialed testing.
Training
Customizable manager application security awareness/secure software development lifecycle (SDLC) training and developer OWASP Top 10 training are offered.
Mobile Apps
We test iOS and Android and services to which they connect.
