Service
App & Web Security (AppSec)
I help application and website owners through security reviews and consultations. I discuss access controls, data flows, APIs and business logic within the limits of the information made available.
Reviews and consultations — the current service scope
I draw on the OWASP approach and knowledge of common application weaknesses to review agreed topics. This service covers reviews and consultations; it does not include active penetration testing, vulnerability exploitation or a full security audit.
Topics we can discuss
- User roles and rules governing access to application data and functions.
- Data flows between the website, APIs and connected systems.
- Business process assumptions and situations in which they could be misinterpreted.
- Questions for the application developer about safeguards and planned changes.
How the review works
I first agree the question the review should answer and the materials available. These may include a feature description, documentation or agreed configuration information. I do not undertake activities outside the approved scope.
Depending on the agreement, the outcome may be a discussion of risks, questions for the developer or recommendations for further changes and verification. It does not automatically confirm the presence of a vulnerability or the completeness of security controls.
What a review alone cannot establish
Conclusions depend on how current and complete the materials are. Documentation may differ from the running system, and the effectiveness of implemented controls cannot be confirmed without agreed verification. Responsibility for fixes and how they will be checked need separate agreement.
Questions and answers
Do I need to provide production customer data before a consultation?
Do not send it in the initial enquiry. I first establish what information is needed; a process description or an example without real data may be sufficient to discuss the issue.
Can I discuss recommendations received from my application developer?
Yes. I can help explain their meaning and dependencies and identify questions requiring clarification. This does not constitute testing or independent confirmation that a vulnerability has been fixed.
How to request a consultation
Describe the application and your specific concern. The audit enquiry form is a way to arrange a review or consultation here, rather than to order a penetration test.
Describe your review or consultation topicRelated areas
The configuration of the application environment is covered by Administration & Hardening.
Requirements concerning data and responsibilities draw on knowledge of Compliance & Risk Management.
Certificates document knowledge and training; they do not demonstrate a particular implementation or, on their own, establish the scope of services offered.