Testing and certification of (web) applications
Protected against attacks
Software applications are becoming more and more important for implementing business processes. At the same time, more and more weaknesses in security are being discovered.
Applications must therefore be especially well-protected because attacks now often come at the application level. Established security solutions from network and system security - such as firewalls - cannot sufficient protect against this: Effective protection must be implemented in the applications themselves.
TÜViT tests your applications and certifies them – thereby contributing to the constant assurance and improvement of the quality of the source code and software design. In addition, the certification provides security in the assigning of development projects if it becomes part of the bid tendering and the contract. Certification is also a competitive advantage for market positioning. In addition, the confidence of supervisory institutions is secured – e.g. through the certification of compliant requirements or for the internal revision.
Our services in detail:
- Analytical process for the efficient examination of applications as per international standards
- Testing of your applications for weak spots with various depths of testing
- Certification of your application
Our method of operation
- Workshop or kick-off meeting for the object to be examined and the testing process
- Determination of the technical security requirements (security level)
- Security analyses and penetration tests of the application on-site or via the Internet with various depths of testing at model installations and the production installation
- Black/gray and white box tests: manual and automated checking for known weak spots, and as per OWASP "Top Ten Most Critical Web Application Security Vulnerabilities"
- Dynamic application analysis of the dataflow, including all of the interfaces, even in byte code
- Static source code analysis
- Correlation of the results determined with the defined security requirements and evaluation in a security analysis
- Exhaustive test report
