Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

What professional standards and practices are recommended for guiding such an effort?

share|improve this question
4  
Hire someone who knows what they are doing. – Rook Apr 9 '12 at 0:21
If we're going to go the route of suggesting hiring someone, I think it would be useful to post qualities to look for in a company you're going to hire to do the audit. – StrangeWill Apr 10 '12 at 20:47

closed as not a real question by Rook, Antony Vennard, AviD♦ Apr 19 '12 at 18:12

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

2 Answers

up vote 2 down vote

As mentioned in the comments, likely for this the best option would be to get in an external company with expertise in this area, if it's something your organisation doesn't have experience of. That said there's several things you could consider in terms of what you want to get from the review which could help you get the right company and commission the right piece of work, some things to consider :-

  • Are there any specific concerns you have with the application? Are you worried about back door code, or is it more that you're interested in general security good practice. Reviewing for back doors is pretty tricky as it can be very hard for automated tools to find them and manual review of large codebases is expensive.
  • Have you reviewed the processes that the development company used to write the application? For ASP.NET a common approach would be to follow Microsoft SDL. If the company used something like this there should be documentation they can provide you around the output of their internal code reviews, threat(risk) modelling and the like. It's not a guarantee but if they've got a good internal process it's more likely that the application will have a decent level of security.
  • Do you want the 3rd party review company to do a code review (white-box) assessment, or a more traditional web application test which is usually more of a black-box affair?
  • Are there any regulatory concerns (eg, PCI). Things like that can help frame a minimum level of security that the application should have and focus the assessment.
share|improve this answer
up vote 1 down vote

Good place to start is OWASP project. In this case I think that OWASP ASVS may come in handy. You can verify your application on L2A or L2B level since you have access to source code.

Unfortunately you probably won't be able to properly test your application if you don't have any experience in this area, so hiring someone is really good move. Of course even if you hire someone you need to specify the goal of this test (saying "I want by application to be secure" is not a good idea), and again - in my opinion - using ASVS as a checklist is really good choice.

share|improve this answer
Anyone who accepts a contract with the terms of "I want the application to be secure" isn't anyone worth hiring. – Ramhound Apr 12 '12 at 17:09
Unfortunately clients often cannot provide more specific requirements, at least at the beginning of the project. Especially if it is the first security assessment of theirs application. I agree that good consulting company should help the client to define assessment's goals, that's why I've mentioned about OWASP ASVS. – pgolen Apr 13 '12 at 8:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.