Security Audits based on ISO/IEC 27001

Customers, investors and larger B2B partners increasingly ask how you protect their data - often with a security questionnaire or a request for ISO/IEC 27001. We review your application and the way it is built and operated, show you where you stand, and help you close the gaps.

What we audit

The application

• Code review for common vulnerabilities: injection, broken access control, insecure direct object references, mass assignment, cross-site scripting and request forgery
• Authentication, sessions, password handling and authorization rules
• Handling of personal and sensitive data, including logging and backups
• Dependencies with known vulnerabilities
• Static analysis with tools like Brakeman, checked by hand for false positives and missed issues

Development and operations

• Access control to repositories, servers, databases and third-party services
• Secrets management and key rotation
• Change management: code review, Continuous Integration and Continuous Delivery
• Logging, monitoring and incident response
• Backup and restore - including whether a restore was ever tested
• Patch and vulnerability management

ISO/IEC 27001

ISO/IEC 27001 is the international standard for information security management systems, part of the ISO/IEC 27000 family. We map our findings to its Annex A controls, so the results are useful for your certification project and for answering customer security questionnaires.

Certification itself is granted by an accredited certification body. Our part is to prepare you for it: a gap analysis of where you stand, concrete measures for the technical controls around your software, and the evidence your auditor will ask for.

What you get

• A written report with findings ranked by risk, each with a concrete recommendation
• A mapping of the findings to ISO/IEC 27001 controls
• A debrief call with your team
• On request, the fixes themselves - followed by ongoing security maintenance so the results don’t erode over time

Summary

A security audit tells you where you stand before a customer, an auditor or an attacker does. We know Rails applications from the inside and look at both the code and the processes around it.

Preparing for ISO/IEC 27001 or a customer security review? Get in touch.