If you have your own software implemented externally, you should define a detailed description of the security architecture for the implementation partner. This includes the specific mechanisms and configurations with which the software security concept and corresponding mechanisms are to be implemented. We help you with the appropriate specification of the necessary measures.

The central component of an analysis of the security architecture is the product- or service-specific software security requirements. These form the expectation horizon for the investigations and the final evaluation. The focus is on an assessment of the potential extent of possible damage with regard to realistic scenarios. In addition, the attack surface of the software and its components is identified. Defects in the general conception, the security requirements and in the detailed specification of specific measures are pointed out in the context of the analysis of the security architecture, and recommendations are given in order to be able to meet these aspects adequately.

This type of project focuses on your internal development and its management and looks at the implementation of the software and, if desired, the backend systems involved: The evaluation reports of this project type provide you with everything you need to make informed decisions: documented requirements and assumptions, detailed descriptions of tests and results for your developers, and meaningful summary assessments for your management. Project results are limited to your internal purposes.

In highly competitive markets, high software security can be the advantage that makes you the market leader. We carry out evaluations that examine the specific security requirements of your solution as part of a targeted evaluation and help you to respond to the security needs and questions of your customers. The project report focuses on the desired security requirements and can be passed on to your customers/partners within the bounds of an NDA.

Test certificates and test reports show your customers and the public that you care about the security of your software. Published by an independent laboratory under the renowned Fraunhofer brand, they convey confidence and strengthen your sales potential. Apps can receive a Fraunhofer SIT certificate if they meet all the security requirements. The certificate itself can be used for marketing purposes as a differentiator from your competitors.

We spend a lot of time attacking software vulnerabilities by, for example, exploiting self-implemented cryptographic techniques, finding implementation errors, and searching for sensitive, insecurely stored data. In software developer trainings, we share our knowledge about which bugs should not be made in software implementations, and to which building blocks known to be secure developers should fall back instead.