When a company wants to buy a new application, the security aspects must be reviewed (access rights, privileges, logs, data integrity ... etc). Is there a standard for applications security reviews? In other words, a checklist that must be followed to check that the security features of a certain application are acceptable?
This question might seem a bit generic, and I'm looking for generic guidelines.
Considering two cases:
- Web application, hosted in my company and im the owner of the web server and Database.
- A locally installed application on host PCs and im the owner of the application server and Database