Threat modeling is the first step in the software Security Development Lifecycle (SDL). Its importance can't be understated as it puts an entire product into clear perspective when talking about security issues. The threat modeling deliverable is also the perfect companion to a meaningful test plan. We can help you through the process of creating useful threat models around your product. This will give you a clear view into exactly what threats affect it, and the users who interact with it. This exercise helps identify mitigations you have, and also guides to you creating mitigations you didn't 't have.
There's some vulnerabilities an automated scanner will find, but for a real view into the security of your applications there's hands on security penetration testing. For the most effective use time, we recommend a source-assisted pen-test. White box and black box approaches have their merits, but it's combining them both that creates a more fruitful environment. We use this gray-box approach to leverage information from the code to improve testing, and we pinpoint critical pieces of the code for thorough review. This method can identify the most issues in design and code-level bugs, and save time in the process.
If a comprehensive application review isn't in your plans, we can streamline the efforts and focus on finding code level defects. When we manage a code-only review we'll run automated tools against your codebase and focus manual review on key areas of your project. No product is too large or too small.
As part of our normal workflow, we engage with your team as virtual members. We'll happily share a room with your testers or developers, and work hand in hand to investing and analyze your product's security. We can put together brown bag presentations tailored to your needs and work with your teams to come up with successful remediations for design challenges you're facing.
Protecting against malware is an arms race. If you want to understand what protections your software should implement to mitigate malware then our services can help. We've worked with the largest social networking sites and top instant messaging products which when improperly designed can serve as malware delivery engines.
Reverse engineering and malware analysis threats of course extend beyond social networking. Casaba has a team of malware researchers with experience analyzing genealogies of malware to identify behaviors, propagations, targets, and purpose. If you have malware or rootkits resident in your systems we can help identify their origins and purpose.
The host configurations making up the application infrastructure are still an important part of the overall security stance. We will review routers, firewalls, web and database server host configurations to ensure a reduced attack surface configuration is in place. Findings will be called out with clear recommendations as to the severity of the issue and how it should be mitigated. We don't typically produce reports with thousands of noisy low-severity findings. It's more valuable to you if we provide clear guidance on the most important issues. We'll bring priority to issues which are exploitable and properly categorize issues which may or may not be.
