App Penetration Common Questions

Data Access

What happens with vulnerabilities your tool finds, how these are stored (length of time etc), who has access to this data?

All the data are stored in the database, the data is stored for how long we need, it can be backed up or cleaned up as needed, or run a scheduler to remove the data periodically.

The Database Admins will have access to these data which again can be changed depending on the requirements.

We do not handle any PII, PHI, or scoped data in our hosted environment. All test data must be generated on fake test accounts. Which is normal procedure anyway. In addition, Test data and scripts are hosted in the client's own GIT repository.

Phone Home Functionality

For an on-premise implementation, does Appvance have any phone home functionality?

For an on-premise implementation, the system has no phone home. It is designed to work within an air-gapped environment (for DOD applications). We would have no access unless you granted it for a specified time.

Source Code Access

My understanding here is also that this is for fully-built software testing, and no source code will be transferred to your company – is this correct?

We never have access to any source code. We only test fully compiled applications.

Low (Medium) vs Medium (Medium)

In the pdf report generated from the App penetration testing, what does "low (medium)" mean or "medium (medium)" mean?

The first statement is the risk level, and the second statement is the confidence level.

• low (medium) = Low risk level and medium confidence level

• medium (medium) = Medium risk level and medium confidence level

CREST Certification

Is the App Penetration functionality in AIQ CREST certified?

AIQ App Penetration tests run ZAP Active scans. However, OWASP ZAP itself is not CREST certified.

CREST, a global cybersecurity industry body, has an accreditation program called OWASP Verification Standard (OVS). Companies like Across Verticals, Nettitude, Pentest People, Trustwave, and VerSprite have received CREST accreditation for their application security assessment services.

Key points about ZAP’s active scan in AIQ App Penetration:

• Vulnerability Detection: Active scanning attempts to find specific types of vulnerabilities, such as SQL injection, cross-site scripting (XSS), and other common security issues.

• Limitations: While active scanning is valuable, it won’t discover logical vulnerabilities like broken access control. For a comprehensive assessment, manual penetration testing should complement automated scanning.

For more information on ZAP see the ZAP Homepage.