Security Testing
Capgemini's security testing services expose vulnerabilities in your web applications and custom-developed software to help you strengthen both internal and external applications against potential threats.
- 1. Application and web server: Check for business logic vulnerabilities, parameter manipulation vulnerabilities, session management, lack of input validation, lack of authentication, weak authentication.
- 2. HTTP/SOAP: Test if malicious users can view sensitive information contained in SOAP requests and responses and see if specially crafted SOAP requests can be used to extract sensitive information from unaudited mainframe APIs
- 3. Mainframe: Check for insertion of malicious code in file processing routines, misconfiguration of access and authorization controls, mainframe APIs exported through unaudited SOAP requests, and privilege to MDM sensitive information from mainframe environment
Our insurance testing offerings include Application Vulnerability Assessment, Threat Modeling and Penetration Testing and include the following steps:
Initiate threat modeling
- Review your security guidelines and gain an understanding of your application
- Prepare threat model
- Prepare threat model estimation
Plan, design & execute security tests
- Create security testing checklist
- Map testing checklist to threat model and OWASP (Open Web Application Security Project)
- Prepare test scope and strategy
- Create threat maps
- Perform penetration testing
- Perform security code review
- Update threat maps for penetration test
- Update threat maps for code review
After testing
- Collate defects and write security defect report
- Deliver security defect & mitigation report
