...
...
...
...
- Overall security rating,
- Vulnerabilities quadrant,
- Effort to reach upper levels of security,
- Top-10 security vulnerabilities,
- Top-10 worst files, and
- Timeline evolution of security indicators
...
| Table of Contents | ||||
|---|---|---|---|---|
|
Security Rating
The Kiuwan Security Rating is a discrete 5-star
...
rating that tells you how secure your application is in terms of the likelihood and impact of the found vulnerabilities.
This rating concentrates all the security evidences found in the source.
| Info | |
|---|---|
|
...
...
= secure 1 star = very insecure |
Security Vulnerabilities
Security vulnerabilities are grouped in a quadrant according to two major axes:
- Impact of the vulnerability, according to the severity of the associated security risk
- Likelihood of the event that could cause the associated security breach
These two axes produce 4 quadrants. Kiuwan summarizes found vulnerabilities for each quadrant
...
In this image, you can see that Kiuwan found 271 vulnerabilities and how kiuwan distributes them in the 4 quadrants:
...
...
...
...
...
...
Security rating is based on following:
...
...
...
...
...
...
...
...
...
...
...
...
...
levels according to the remediation effort associated to fix each vulnerability.
| Info |
|---|
Please note that Very Low vulnerabilites are discarded in the Security Rating algorithm and are not included in 4-quadrant image. That's the reason you could find that the total number of vulnerabilties in the 4-quadrant image is lower than the total vulnerabilities figure. |
Top 10 Vulnerabilities and Worst Files
...
Any vulnerability found by Kiuwan is categorized according to its type:
- Buffer handling
- Control flow management
- Design error
- Encryption and randomness
- Error handling and fault isolation
- File handling
- Information leaks
- Initialization and shutdown
- Injection
- Misconfiguration
- Number handling
- Permissions, privileges and access controls
- Pointer and reference handling
- System element isolation
- Other
The summary dashboard also provides a Top-10 ranking of vulnerability types and worst files.
This way, you can easily concentrate on major contributors to current security rating.
...
...
...
...
...
The Top-10 Worst Files graphic displays a ranking of the worst (low-rated) files of your application, showing the security rating and the number of vulnerabilities found.
Timeline
The Timeline section displays
...
...
Effort (to reach 5-star rating) as well as the total LOC size of your application.
This section also displays information on:
- When a baseline analysis was performed (only applicable if you are using Life Cycle). If you are not using Life Cycle, that date will be current date of the analysis.
- Model used for the current analysis
- Portfolios this analysis belongs to
- Graphical distribution of LOCs in different languages