Begin here

• 01

  Pre-Audit Preparations

  In the lead up to the security audit, we help Defense customers prepare for the audit to optimize the process and make the best out of the audit. We collaborate closely to confirm that the project meets the following necessary criteria for a security audit:

  1. Code: Ensure that the target code is development complete.
  2. Documentation: Verify that code comments are thorough and current, and that project documentation is sufficient.
  3. Tests: Check that there is baseline test coverage that includes unit and integration tests which enable security auditors to learn the system faster, and to create create test scenarios efficiently.

• 02

  Audit Setup and Onboarding

  To start the audit process smoothly, Defense takes the following steps:

  For the launch of each security audit we:

  1. Organize a project kick-off call to meet the development team and receive an overview of target code.
  2. Set up a dedicated communication channel for seamless interaction.
  3. Create a Github repository/ies to track issues in the target code.

• 03

  Comprehensive Manual Security Audit

  Defense security auditors perform a manual review of the target code, according to our established approach.

  1. We review any tests, and create test cases as needed.
  2. We supplement our manual review with security tools as needed.
  3. We ask questions about the code and provide feedback in the dedicated communication channel.

• 04

  Security Audit Report

  Upon conclusion of the manual code review, Defense will create a detailed audit report.

  This report will provide a thorough analysis of the findings, identifying vulnerabilities and weaknesses, and will propose a remediation plan.Upon request, we will schedule a call with the customer to discuss the findings in detail.

• 05

  Verification and Validation (Optional)

  For clients opting for additional assurance, we offer a verification process to confirm the resolution of identified security concerns.

  Once the customer has addressed the issues identified in the security audit report, we review the fixes and assess their effectiveness at addressing the issues.We then provide an updated final report, detailing the current status and the actions taken to address the issues in the initial report.Once the final audit is delivered the customer may publish the security audit report and the engagement is considered complete.