Best Practices for Securing In-House Web Applications

C.

In-house developed web applications are prone to external attacks, and it is essential to ensure that adequate security controls are implemented to prevent such attacks. In this scenario, the IS auditor needs to identify the best evidence that the web application is secure from external attacks.

A. Code review by a third party: A code review by a third party is an essential control that can help identify vulnerabilities in the application's code. This process involves a detailed examination of the application's source code to ensure that it is written according to best practices and is free from coding errors and security flaws. Although a code review by a third party is a valuable control, it may not provide the best evidence that the application is secure from external attacks.

B. Web application firewall implementation: A web application firewall (WAF) is a security solution that can be deployed to protect web applications from common attack vectors. A WAF can be configured to block requests that are identified as malicious or anomalous, preventing attackers from exploiting vulnerabilities in the application. While a WAF is an essential security control, it may not provide the best evidence that the application is secure from external attacks.

C. Penetration test results: Penetration testing is a process that involves simulating real-world attacks on an application to identify vulnerabilities that could be exploited by attackers. Penetration testing provides valuable evidence that the application is secure from external attacks. The results of a penetration test can be used to identify vulnerabilities that need to be addressed and to verify that the security controls implemented are effective.

D. Database application monitoring logs: Database application monitoring logs are records of activity that are generated by the application's database. These logs can be used to monitor user activity and identify any suspicious behavior or unauthorized access attempts. While database application monitoring logs are useful in detecting potential security incidents, they may not provide the best evidence that the application is secure from external attacks.

Therefore, the BEST evidence to an IS auditor that the web application is secure from external attack is penetration test results. Penetration testing provides a comprehensive assessment of the application's security controls and can identify vulnerabilities that need to be addressed.