New answers tagged

0

The SaaS offerors are not likely to agree to let you pen test their services. They might agree to independent testing but the testing frameworks are not likely to be comparable. So you will be hard-pressed to compare the findings by one to that of another. Unless you are soliciting $1B in business, perhaps FedRAMP certification is the best you can hope for. ...


3

In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS ...


0

I can think of following scenarios: Safety against SQL injection and login related attacks if your software has user accounts The accuracy and robustness of your access control if your software has users


0

There are a few free static analysis tools for PHP, take a look at this OWASP link for more details. RIPS is now abandoned, but according to their sourceforge page, a new version is in the works... DevBug is an online tool, but its reporting is basic. Static analysis won't find every possible bug, it should be used as part of a more complete testing ...


0

2) Use private key to create a signature of the public key. 3) Upload the public key and its signature to the FTP server. 4) Mobile device downloads the public key and its signature. 5) Mobile device uses the public key to verify the signature. Why do this. Anyone who can create a keypair can sign the public key via the corresponding ...



Top 50 recent answers are included