Why Web Application Security

The need for proactive Web Application Security has arisen because of the way industry has adopted the Web as a means of doing business.

• Growth in Web Applications as a Business Enabler
  - Requirement for functionality, features, dynamic user-driver content and real-time updates has outpaced security controls
  - Last stats from Gartner said 80% of business will have their online app compromise by 2010
  
• System Security Does Not Reach High Enough
  - AV, system patches and OS control have no impact on the custom developed application
  - By design, web application is accessed by untrusted users from untrusted computers
  - It is designed to be open to external entities
• Network Controls Don't Address Open Business Channels
  - The perimeter security model where all but legitimate traffic is blocked is not longer valid
  - Hackers embed attacks in legitimate traffic
  
• The New Attack Paradigm - Drive-by Downloads
  - No longer focusing on web applications and servers but on end users
  
• Increasing Institutional Pressure
  - More requirements for web app sec in legal and regulatory controls e.g. PCI DSS.

CodeSecure

CodeSecure is a hosted software service providing Static Source Code Analysis and Verification for PHP, J2EE, .NET and ASP.

By proactively addressing code vulnerabilities throughout development, CodeSecure™ ensures vulnerability-free and hacker-proof web applications from the outset, and represents a cost-effective and risk-free alternative to the common build-first secure-later paradigm.

As a white box testing platform it greatly complements the more traditional web application pen-testing model as it not only identifies the vulnerabilities but also the specific line of code causing them.

• The only true 3rd Generation Static Source Code Analysis solution on the market.
• Utilizes its own built in compiler and interpreter on a web accessible appliance
• Fully emulates run-time activities offering greater accuracy, precision, coverage and speed.
• Pinpoints application entry point, vulnerability and flawed line of causing it.
• Reports trace and detail all vulnerabilities offering guidance and prioritized remediation steps
• Available as a Software as a Service (SaaS)