Security Audits

Score	Audit	Audit Date	Property	Verification	Notes
A+	Qualys (SSL Server Test)	31st May 2022	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A+	ImmuniWeb	31st May 2022	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A+	CryptCheck	31st May 2022	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A	Security Headers	16th March 2021	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
A	UpGuard	31st May 2022	mid.as pentest.mid.as midas.network	[Verify] [Verify] [Verify]
✓	Virus Total (Virus Scan)	31st May 2022	mid.as midas.network	[Verify] [Verify]
✓	Sucuri SiteCheck (Malware Scan)	31st May 2022	mid.as midas.network	[Verify] [Verify]

Security Assessments

NCSC - SaaS Security Principles - MIDAS Evaluation (July 2022)
NCSC - SaaS Security Principles - MIDAS Evaluation (July 2021)

Security Testing

There are two main types of web application security testing; "Static" and "Dynamic".
Both testing methodologies can identify potential security flaws within software applications.
Each methodology is different, and we employ both types in the development cycle of our MIDAS software....

SAST

Static Application Security Testing (SAST), or static code analysis, is a testing methodology that analyzes raw source code to find security vulnerabilities that could make software applications susceptible to attack. It's also sometimes known as "white box testing".

Here at MIDAS, we perform SAST as part of our routine development process. Our development tools automatically scan the MIDAS source code as we work on it, alerting us to any potential code vulnerabilities early in our software development life cycle (SDLC).

As this is a continuous and automated process, we do not produce and publish reports for our internal SAST.

DAST

Dynamic Application Security Testing (DAST), sometimes referred to as "black box testing", differs from SAST. Where as SAST performs tests on raw source code, DAST facilitate the automated review of a web application - in our case MIDAS - with the expressed purpose of discovering security vulnerabilities.

DAST helps discover run-time and environment-related issues that would otherwise not be detected by means of SAST.

Whilst we perform our own internal dynamic application security testing, DAST is also a method by which external security researchers can uncover potential security issues within our software.

As part of our transparent approach to security, we endeavour to make DAST reports available upon request.