Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and does individual projects will look at the source code and will also do penetration tests, etc.

Now while it will make me feel comfortable that somebody who is well-versed with it will be scanning the site and making necessary changes if need be but i am uncomfortable with the fact that that one person will know how we code things and how we process things.

Now i have two options, either i let him test the site on our website that we need it for or i move the site to another domain and call it something else. But I also want him to sign a NDA agreement which will then have to have my company's name on it. So i am sort of lost?

How does one allow third party audits without being vulnerable to them?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

I'd echo what the other answers have said in that what you're describing is a fairly standard security review process and if done properly you shouldn't have much to worry about in terms of the audit company having access to your data.

A couple of points which may be of use

  • In choosing the company if there are any well-known industry bodies, you could consider using an accredited provider (eg, in the UK there's CREST ). as @D.W. says, testing companies are professional organisations and even an accusation of misusing customer data would be bad for them, so I'd expect most to be very careful with that side of things.
  • Contracts and NDAs should be in place between your companies. Part of that would of course include a requirement that they don't misuse any data from the test.
  • One point you mentioned about the auditing company making changes to your site. Usually a security testing firm would just report results and make recommendations for change rather than actually altering a live system, and I'd say that's a good approach. The audit company won't have a complete knowledge of your systems, so it could be risky for them to make changes to them.
share|improve this answer
    
Roy! Thanks for your response. The auditor said she would report back to me as you suggested and then also make the code changes if necessary. –  Sam Khan Mar 19 '12 at 0:49
1  
@sam generally it is still better for the programmers who wrote the code to understand and fix the issues. Most importantly as a learning excercise so future revisions or applications don't reintroduce the same or similar issues. Personaly I would get the programmers and the auditor to come up with updated code together. –  Bernie White Mar 19 '12 at 8:11
    
@SamKhan - I suggest the security firm just start with blackbox testing. The developers who designed the website should do the fixes. –  Ramhound Mar 19 '12 at 13:11
add comment

I think your fears are overblown. My recommendation is to choose a third-party auditor you trust and give them full access to your site (your code, everything). Sure, have them sign a NDA, that's entirely reasonable. But be realistic: they're not going to steal your IP. They're professionals, and their career and their business relies upon trust; they would be crazy to steal one person's IP. And, odds are, your site's code isn't worth that much to anyone anyway. There is no need to try to conceal your company's name, to move your domain, or to limit their access to your site and your code.

share|improve this answer
    
Hi! I didn't mean IP, i meant they might try to hack in or something along those lines. –  Sam Khan Mar 19 '12 at 0:48
    
@SamKhan - If you website is actually PCI compliant then there shouldn't be anything of worth stealing even if they were to hack you. If they were to hack you, it would be a trivial task, to link it to them. Clearly a test website with a segment of real data on it is a good idea. –  Ramhound Mar 19 '12 at 13:13
add comment

For an accurate penetration test / security assessment and code review the context of the website need to be known and will help identify what may be the vulnerabilities. If are you are not open with these details the assessment may not find everything.

Promote it

Going through a security assessment is nothing to be ashamed of, it is standard practise and promoted as a positive by many companies. It is more important what you do with the results.

Confidentiality

You are right you will want them to sign a deed of confidentiality, non-disclose agreement (NDA) or other contract. Most reputable security firms take this very seriously, however if you are concerned then you should state in the contract how the information and the report will be handled. Such as the report and any data collected is not permitted to leave your site.

Use a test but fully functional version

A security assessment can bring a web site down or break functionality depending on what vulnerabilities are found (there is always something). I would suggest that you have a test site with sample/test data that it configured as close to the real one as possible.

Hope this helps.

share|improve this answer
    
I agree with all your points including the 3rd one. Do you do consulting work? –  Sam Khan Mar 19 '12 at 0:47
    
@SamKhan - Based on the quality of the post I would say thats a safe bet. Its clear he does something of that nature. –  Ramhound Mar 19 '12 at 13:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.