Vulnerability Assessment

Vulnerability Assessment searches systems for known vulnerabilities. It is a list based approach where you test your application against all known vulnerabilities, and if detected, you should fix those immediately.

How It Works

It is performed on an occasional basis and can be completely automated by using platforms like Appknox SAST, DAST, and APIT. Some of our customers perform vulnerability assessments on their apps as occasional as on a weekly basis, depending on their release cycles.

Steps Post Binary Upload.

SAST

Static Analysis is done over the mobile app binary to gather different data. These include the resources and hardcoded strings that are packed into the application binary.

Know more about SAST

DAST

Dynamic Analysis is done by running the application over real-time
devices, set up in a real environment (device-farm) where the user can interact with the devices rendered though the browser and operating different kinds of data-flow analysis over memory dumps.

Know more about DAST

Dynamic Induced API Security Testing

API Analysis is performed on the HTTP requests that the app makes during the dynamic analysis. The API server is tested for common web server vulnerabilities.

Know more about APIT

Penetration Testing

Penetration Testing attempts to identify insecure business logic, security setting vulnerabilities, or other weaknesses that a threat actor could exploit — transmission of unencrypted passwords, password reuse, etc.

Appknox makes use of the hacker approach to uncover sophisticated security threats that cannot be detected in vulnerability assessment.

Comparison

Vulnerability Assessment

List-based approach to evaluate security for application
Detection of possible loopholes that could be exploited
Automated process to secure mobile apps
Secure your Applications from 0-days
A methodological approach to risk management
Automated process to secure mobile apps
Secures application from internal and external risks
Identify security issues occurred at the development phase

Penetration Testing

Depth based approach
Helps you to uncover complex security threats that cannot be detected in vulnerability assessment
Analyses the risk of the attacks occurred with a risk score
Hacker approach to identify security issues
Simulates vulnerability further to create a customized attack
Final report of the issues
Remediation call to help your team how to fix security issues