Security Audits

Score	Audit	Audit Date	Property	Verification	Notes
A+	SSL Server Test	10th July 2020	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A+	ImmuniWeb	10th July 2020	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A+	CryptCheck	11th July 2020	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A	Security Headers	10th July 2020	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A	UpGuard	11th July 2020	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
B	Web Cookies	11th July 2020	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]	B grade due to 3rd party services (i.e. Google Analytics & Cloudflare)
✓	Virus Scan	10th July 2020	mid.as midas.network	[Verify] [Verify]

Security Assessments

NCSC - SaaS Security Principles - MIDAS Evaluation (July 2020)

Security Testing

There are two main types of web application security testing; "Static" and "Dynamic".
Both testing methodologies can identify potential security flaws within software applications.
Each methodology is different, and we employ both types in the development cycle of our MIDAS software....

SAST

Static Application Security Testing (SAST), or static code analysis, is a testing methodology that analyzes raw source code to find security vulnerabilities that could make software applications susceptible to attack. It's also sometimes known as "white box testing".

Here at MIDAS, we perform SAST as part of our routine development process. Our development tools automatically scan the MIDAS source code as we work on it, alerting us to any potential code vulnerabilities early in our software development life cycle (SDLC).

As this is a continuous and automated process, we do not produce and publish reports for our internal SAST.

DAST

Dynamic Application Security Testing (DAST), sometimes referred to as "black box testing", differs from SAST. Where as SAST performs tests on raw source code, DAST facilitate the automated review of a web application - in our case MIDAS - with the expressed purpose of discovering security vulnerabilities.

DAST helps discover run-time and environment-related issues that would otherwise not be detected by means of SAST.

Whilst we perform our own internal dynamic application security testing, DAST is also a method by which external security researchers can uncover potential security issues within our software.

As part of our transparent approach to security, we endeavour to make DAST reports available upon request.