Acunetix Compliance Reports

Compliance Report – 2011 CWE/SANS Top 25 Most Dangerous Software Errors

The 2011 CWE/SANS Top 25 Most Dangerous Software Errors is a list of the most widespread and critical errors that can lead to serious vulnerabilities in software. They are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all.
 
 

Compliance Report – DISA STIG Web Security

This Application Security and Development Security Technical Implementation Guide (STIG) provides security guidance for use throughout the application development lifecycle. This STIG provides the guidance needed to promote the development, integration, and updating of secure applications. Subjects covered in this document are: development, design, testing, conversions and upgrades for existing applications, maintenance, software configuration management, education, and training.
 
 

Compliance Report – International Standard – ISO 27001:2005

ISO/IEC 27001 is an information security management system (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 – Information technology – Security techniques – Information security management systems – Requirements. The objective of this standard is to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an Information Security Management System.
 
 

Compliance Report – International Standard – ISO 27001:2013

ISO/IEC 27001 is an information security management system (ISMS) standard published in September 2013 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2013 – Information technology – Security techniques – Information security management systems – Requirements. The objective of this standard is to provide a model for establishing, implementing, operating, monitoring, reviewing,
maintaining, and improving an Information Security Management System.
 
 

Compliance Report – NIST Special Publication 800-53 – Recommended Security Controls for Federal Information Systems

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure.
 
 

Compliance Report – OWASP TOP 10 2013

The primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the consequences of the most important web application security weaknesses. The Top 10 provides basic techniques to protect against these high risk problem areas – and also provides guidance on where to go from here.
 
 

Compliance Report – Payment Card Industry Data Security Standard version 3.0

The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect cardholder data. PCI DSS applies to all entities involved in payment card processing-including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data (CHD) and/or sensitive authentication data (SAD).
 
 

Compliance Report – Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (HR 3763), signed into law on 30 July 2002, is considered the most significant change to federal securities laws in the United States since the New Deal. The act was designed to review dated legislative audit requirements and protect investors by improving the accuracy and reliability of corporate disclosures.
 
 

Compliance Report – The Health Insurance Portability and

The confidentiality of health information is threatened not only by the risk of improper access to stored information, but also by the risk of interception during electronic transmission of the information. The purpose of this final rule is to adopt national standards for safeguards to protect the confidentiality, integrity, and availability of electronic protected health information.
 
 

Compliance Report – Web Application Security Consortium: Threat Classification

The Web Security Threat Classification is a cooperative effort to clarify and organize the threats to the security of a web site. The members of the Web Application Security Consortium have created this project to develop and promote industry standard terminology for describing these issues. Application developers, security professionals, software vendors, and compliance auditors will have the ability to access a consistent language for web security related issues.
 
 

Developer Report