What is Application Assessment/Code Review?
As organizations produce applications that are used for various business critical features, it’s important to be sure that they do not contain serious vulnerabilities. With ever-changing attack surfaces, developers are often deficient when it comes to writing secure code, producing insecure programs that can result in a breach of a company’s infrastructure and cause economic and reputational risks.

How does it work?
By having Syndis do an assessment of applications, either as a one-off assessment or a continuous review when major changes are made, companies can be reassured that the code they are shipping has had a rigorous security review and that risks of major breaches occurring have been minimized.

By combining white box and code review techniques as a part of the assessment, the security review can be much more in-depth and catch more issues in less time. The approach also allows for potential design flaws to be found, and other improvements in the application can be suggested to mitigate potential future issues.

Any such project is scoped based on the size and importance of the application system that requires review. Customers then either provide access to the code of the application or relevant binaries for decompilation. Using the code as a resource Syndis can conduct very targeted testing in accordance with OWASP top 10 and other requirements. 

Why is it relevant?
Developers can always make mistakes as far as writing secure code goes. It is imperative that companies try and catch security vulnerabilities before they are exploited by attackers and cause damage.

We believe that our approach that combines the code review with actual security testing gives a higher ROI for our customers and gives us the ability to interact directly with development teams during the period of engagement.