Security Code Review for Custom Applications

Rietta will review the security of your custom web, mobile, or desktop application’s source code. Security code review is the core of our application vulnerability assessment, which measures the whole application against OWASP ASVS or MASVS, and of our fixed-price authentication and access control audit, which goes deep on sign-in, sessions, and permissions.

This open book review is a suitable substitute for many pen test engagements and will provide your company with an affordable way to enumerate issues that your team can fix and to answer your customers’ security inquiries.

Engagement May Include

• Review code and cloud infrastructure and produce a signed security assessment report suitable to provide to your customers
• Answer security questionnaires from enterprise clients
• Attend conference calls and meetings as your security expert as needed
• Develop compliance strategies to align existing practices with external cybersecurity requirements

What We Review Against

• User identity management and password storage, against NIST SP 800-63B
• Secure software development processes, against Executive Order 14028 and NIST SP 800-218, the Secure Software Development Framework
• The OWASP Application Security Verification Standard (ASVS) for web applications and APIs, or MASVS for mobile apps

To assess the maturity of your organization’s secure development program as a whole, see our secure development program assessment (OWASP SAMM).

We take an open book approach in collaboration with your development team. We review source code, conduct interviews, and use certain automated tools. We then provide our clients with a written report of the findings along with an optional bridge letter that explains the assessment in a way suitable for presenting to your clients or other interested third parties.

Answering Questionnaires and Expert Advice

Our security expertise can be invaluable during an incident response or when you just want to get ahead of the security concerns that your clients may have.