Government departments, public sector undertakings, banks and many enterprises require a security audit clearance before a web application goes live. An independent auditor tests the application for vulnerabilities, and the application is cleared only when all significant findings are fixed. Knowing what to expect makes the process faster and less stressful.
The process
- Scoping — the auditor and owner agree what will be tested: URLs, roles, features.
- Testing — the auditor tests the application using automated tools and manual techniques, usually on a staging environment.
- Report — findings are listed with severity, evidence and recommendations.
- Fixing — the development team fixes each finding.
- Re-testing — the auditor verifies the fixes, sometimes over several rounds.
- Certificate — once no significant issues remain, a clearance certificate is issued.
For many government projects, the auditor must be from an organisation empanelled by CERT-In; check the requirements of the department concerned.
Common findings
- Missing security headers
- Weak session and cookie settings
- Cross-site scripting in forms or search
- Insecure direct object references — accessing others' records by changing IDs
- Detailed error messages revealing technical information
- Weak password policies and no account lockout
- Outdated libraries with known vulnerabilities
- Unrestricted file uploads
- Sensitive data in URLs
Getting cleared faster
- Harden before the first audit — fix the common issues proactively.
- Fix the root cause, not just the specific example reported, so variants do not appear in the next round.
- Provide a stable test environment with test accounts for each role.
- Document fixes clearly for the auditor.
After clearance
Keep the application updated and re-audit after significant changes, as most departments require.
We fix findings, harden applications and support re-tests — see web application audit clearance.
0 comments