Independent Web Exposure Assessment Supporting SARE

Background

Old River Wolf Security was engaged to assess a staging environment supporting SARE. The engagement originated through discussions with Steven Ayers of Sovereign Stack, one of the developers involved with the project.

Objective

Provide an independent assessment of defined web workflows while development was underway and the project team still had room to evaluate options. This was not certification and it was not a full penetration test.

Authorized scope

The assessment focused on five agreed workflows and user interactions in the approved staging environment. Denial-of-service testing, credential attacks, destructive testing, internal network testing, and unrelated systems were excluded.

Approach

ORWSec performed a human-led Web Exposure Assessment using established application-security methods and tools. The review covered externally observable behavior, workflow logic, authentication and session handling, access-control observations, input handling, and error conditions. Potential concerns were validated before inclusion in the final report.

Deliverables

• Final Web Exposure Assessment report
• Supporting evidence package
• Raw assessment session data
• In-person report review and findings discussion

Deliverables were securely provided directly to project stakeholders.

Outcome

The assessment was completed, reviewed with stakeholders, and delivered through the established University procurement process. Its primary value was timing: assumptions were examined before deployment rather than after they became operational dependencies.

Acknowledgments

ORWSec acknowledges Steven Ayers and Sovereign Stack, Dr. Kristy Borrelli and the SARE program, and the University of Maryland for their roles in making the engagement possible.

Now read how the engagement actually began →

University of Maryland and SARE are identified to describe the engagement and do not imply endorsement or certification.