Adaptive SystemsSecurity reviews
We look for weaknesses in your web application and server, rank each by the harm it could do, and show you how to close it.
What a review covers
The scope is agreed in writing beforehand. Reviews combine configuration assessment, vulnerability testing and authorised penetration testing, as agreed in the written scope. A typical review of one application covers these six areas.
The application
We test forms, logins and anything else that accepts input.
The aim is to find out whether the application can be made to reveal data by a malicious party, or to act on behalf of the wrong person.
We work from the OWASP Web Security Testing Guide and check for the risks in the OWASP Top 10.
The server
We check what the server exposes to the internet.
We look at what is out of date, who can log in, and how.
We also check whether an intrusion would be noticed.
The configuration is compared with the CIS Benchmarks.
Email and domain
We check whether someone else can send mail in your name.
We also check whether your own mail is being marked as spam, and whether its SPF, DKIM and DMARC records are set up correctly.
Problems here are usually quick to fix.
Secrets and dependencies
We search for passwords and keys left in code or backups.
We check the software your application depends on against published vulnerability advisories (CVE).
The report lists what to update and what to remove.
Personal information
We check how the personal information you hold is kept, and who can reach it.
The Privacy Act 2020 expects an organisation to protect the personal information it holds with reasonable security safeguards, and to tell the Privacy Commissioner about a privacy breach that has caused or is likely to cause serious harm. A weakness that would expose customer or staff records is reported with that in mind.
We compare what the application collects, keeps and sends with what you tell people.
Recovery
We check that backups exist and that one has been restored successfully, because a backup that has never been restored may not work when it is needed.
The report estimates how long recovery would take, and how much recent work would be lost.
What you walk away with
The report serves two readers, the manager who decides priorities and the developer who closes each weakness, and it is laid out for both.
A summary for managers
The report opens with one page that a manager can read in five minutes.
It says how exposed the application is and what needs doing first.
It gives you a summary you can show a board, an insurer or a customer who asks what you have done about security.
Findings, with evidence
Each finding shows what we did and what came back.
Weaknesses we demonstrated are kept apart from ones we could only suspect, so you can tell the two apart at a glance.
Each is rated by what an outsider could do with it and how easily.
Fixes, in order
Each finding comes with a recommended fix and its place in the order of work.
Your developers can act on it directly. Quick fixes, such as a setting or an email record, are marked as quick.
If you would rather we made them, we quote for that and check each one afterwards.
The scope and methods
The report states what was tested, how, and on which dates.
It names the systems in scope, the methods used, and anything left out.
New weaknesses are found in software all the time, so the report describes the application as it was when we tested it.
Questions about security reviews
Our application was built quickly by a small team. Is it likely to have problems?
Applications built quickly often share the same few weaknesses, and they are the ones we look for first: passwords and keys left in the code, forms that trust whatever is typed into them, and settings left at their defaults. They are quick to find and usually quick to fix.
Does a review cover what the Privacy Act expects of us?
The Act expects reasonable safeguards around the personal information you hold, and a review checks the ones the application actually has: how it keeps personal information, who can reach it, where it sends it, and whether a break-in would be noticed. The report states what we found, with evidence, and what to fix first, so you can show what has been done about it.
The Privacy Commissioner advises a privacy impact assessment early in any project that collects or handles personal information. Does a review cover that?
A review gives you the technical part of one, with evidence: what personal information the application collects, where it keeps it and for how long, who can get at it, and where it sends it. The assessment itself, which asks what the information is for and whether you need to collect it, is yours to write, and the Privacy Commissioner's guidance says what goes into it. We can go through the technical sections with you once an audit is complete.
We are small. Would anyone bother attacking us?
Many attacks are automated. Programs scan large ranges of internet addresses for known weaknesses, whatever the size of the organisation behind them. That is often how a small business experiences a malicious incursion, such as a ransomware attack.
Will a review take our site offline?
We design the review not to. Where it must take place on a live system, we agree on safe test accounts, permitted actions and measures to protect production data before starting, and anything that could affect a live service is agreed with you first or done on a copy. We ask you to take a backup beforehand.
Can we go through the findings with you?
Yes. We are in Auckland and work in your hours, so we go through the report with you on a call or, if you are nearby, in person.
Can you fix the problems as well?
Yes. We quote for the fixes, make them and check each one again; your own developer or IT provider can make them instead. Ongoing maintenance and support may be available for applications we review. It is scoped separately, and where an IT provider referred you to us, we discuss it with them first.
How small a job will you take on?
Small jobs are welcome. A review of one application, or a few days spent on one part of it, such as the login or an API, can be quoted on its own. We scope each job to what you need, and if a smaller one would answer your question, we say so.
What does a review cost?
It depends on the size of the job: how many applications and servers are in scope, how users log in, and how much personal information is held. Ask for a quote. The written scope says what is in, what is out, and the price.
Find out where you stand
Tell us what you run and who uses it, and we will say what a review would cover and what it would cost.