Application Security Auditing

We perform cybersecurity audits on all types of computer applications, regardless of the language in which they are developed. In this context,overall we can distinguish between three types of applications: web, mobile (smartphone, tablet, etc.) and desktop (Windows, Linux, Mac, etc.).

Our audits identify all existing risks, classify them by their criticality and propose solutions for them, all by using our own methodologies developed using the standards.

In addition to the audit, we can complement our App audits with a development lifecycle assessment and improvement service. This service is aimed at clients who produce their own software, allowing us to evaluate the whole life cycle of the products (analysis, design, implementation, integration, testing, maintenance, etc.) from a security viewpoint and propose improvements.

All of our audits are composed of a complete analysis carried out by a team of experts, through which all exploited parameters will be evaluated in order to take corrective actions so that the product is protected and secure against exposure to possible cyber-attacks.

Request information

Types of audits

Application auditing services consist of several phases: static code analysis, test plan development, dynamic analysis, operation and reporting. In this type of audit, as a general rule, the source code is available, as well as the libraries used and the details of the infrastructure.

To perform a complete audit, whether the correct functioning of an application depends on or is subject to an ecosystem where several applications interact must be taken into account, for example: a mobile application that communicates/interacts with one or more Web services. In these cases the phases of the different analyses are performed on each of the components, and then an audit is performed on the whole application as well as its services.

One aspect that sets us apart from our competitors is that we are able to exploit the detected vulnerabilities, eliminating false positives and making the exercise not merely theoretical. If vulnerabilities have been found in the first audit, a second audit is recommended in order to verify that any defects have been resolved.

Three types of audits can be defined depending on the requirements of the audit:

White box audit

The auditing team has access to the source code of the application and all the components with which it interacts that are also to be audited. In this case audit configurations and policies of the environment, systems, networks, services, and applications are audited in order to find vulnerabilities, threats and critical points that allow users with a certain degree of privileges to compromise the operation of the application.

Grey box audit

This type of audit allows the auditor to assume the role of a client, with limited privileges. According to the client's discretion, the audit team could have partial access to the source code of the application, or they may have access to the full code of the application to be tested, but not to the code of the rest of the applications and services with which it interacts.

Black box audit

Allows the auditor to assume the role of an attacker, without having access to any of the characteristics which make up the application nor to the environment with which it interacts.

Application Security Auditing

Types of audits

White box audit

Grey box audit

Black box audit

Do you need an expert?

Our team at Jaymon Security is made up of the best experts in cybersecurity. Don’t hesitate to contact us to request our services.

National Institute of Cybersecurity (INCIBE) registered company

Spanish Cybersecurity Catalogue registered company