Custom development · Custom development
Secure development and code audit
Security practices built in from the earliest stages of the development cycle, plus an audit of the code you already wrote.
- Scope
- Your own and third-party code
- Techniques
- Static and dynamic analysis
- Duration
- 3 to 8 weeks
- Includes
- Training for the development team
The problem
Fixing a vulnerability in production costs a multiple of what it costs to avoid it at design time. Secure development is not a review at the end: it is a set of practices applied from the very first line.
What it includes
Code vulnerability assessment
Thorough review to identify and mitigate vulnerabilities, with concrete recommendations to strengthen defences against possible attacks.
Special audits
Compliance audits against data protection standards and regulations, referred specifically to your own developments.
Secure development
Security practices integrated from the earliest stages of the software lifecycle, with secure coding techniques and static and dynamic analysis tools.
Training for the team
Customised secure development programmes for your developers, focused on current threats and best practices.
How we work
- 01AssessmentReview of the code, the dependencies and the deployment channel.
- 02AnalysisStatic and dynamic, with manual verification of the findings.
- 03CorrectionSupport for your team in prioritised remediation.
- 04PracticesControls built into the workflow so it does not happen again.
Deliverables
| Document | Length |
|---|---|
| Findings report With severity, CWE and proposed fix. | included |
| Secure coding guide Adapted to your language and framework. | included |
| Controls in the pipeline Automatic analysis on every change. | included |
It can be applied to software already in production. There is no need to wait for the next project: the code audit and the automatic controls can be set up on what you already have running.