網絡應用程式安全漏洞評估

Upon received all the required information from the Application Form for Web Application Vulnerability Assessment, the assessment would be started asap if our scanner is available.

The duration of the assessment depends on different factors:

• structure and complexity of the application,
• performance of the web server to be scanned,
• number of user roles in the application, the maximum scanning windows for each user role is 7 days.
• etc.

Please note that if there are multiple user roles in the application, the scan tasks are unable to conduct concurrently since it usually affects the performance of your web server to be scanned.

If any critical vulnerability is found in an assessment, the vulnerability has to be fixed and schedule for reassessment until no critical vulnerability can be found in the assessment.

The scanners for web application assessment will attack your application which could damage the files and/or database of the application.  So please ensure the following before the scan task can be started:

• Prepare a testing / development environment with few testing data for assessment use.
• Reserve enough time for the assessment especially there are multiple user roles involved in the application.
• Backup all the data and source code before the scan, and make sure that the backup can be restored properly if necessary.
• DO NOT use production / real data especially real-email address(es) since the scan task could trigger to send out the emails.