Description

Wolkvox implements a secure development approach across all its software solutions, integrating information security into every stage of the Software Development Life Cycle (SDLC). The engineering team follows strict policies and guidelines, based on recognized standards such as OWASP Top 10, to prevent vulnerabilities and guarantee the integrity, confidentiality, and availability of the code.

Furthermore, periodic security audits and controls are performed, and SonarQube is used for exhaustive source code analysis. Continuous training of personnel in secure development best practices ensures that the teams are up-to-date on the latest threats and mitigation techniques.

Features

Integration of Security into the Software Development Life Cycle (SDLC)

• Secure Design: Security is considered from the design phase, applying principles such as "Security by Design" and “Privacy by Design.”
• Code Review: Static and dynamic analyses of the source code are performed to identify and correct vulnerabilities before implementation.
• Security Testing: Includes penetration testing and vulnerability analysis based on OWASP Top 10, to validate the software's resilience against attacks.

Advanced Tools for Secure Development

• SonarQube: A static analysis tool that scans the source code for vulnerabilities, bugs, and poor practices, allowing for early corrections.
• Automated Audits: Integration of tools that verify compliance with security standards and the absence of malicious software or vulnerable components.

Training and Security Culture

• Continuous Training: Engineering personnel receive periodic training in secure development, including topics such as:
  • Code injection (SQL, XSS, etc.).
  • Secure authentication and session management.
  • Protection of sensitive data.
• OWASP Top 10 Awareness: The teams are familiar with the 10 most critical vulnerabilities according to OWASP, applying controls to mitigate them.

Security Controls and Audits

• Internal and External Audits: Periodic reviews are conducted to validate the integrity of the code and the effectiveness of the implemented security controls.
• Component Management: Third-party dependencies and libraries are monitored to avoid the use of components with known vulnerabilities.