How can I easily determine if a website security company is reputable?

Question

Is there a BBB-type listing or some other reputable badge I should look for when choosing someone to perform a security review?

Answer 1

No, I don't think there are any well formulated listings or badges.

From my experience a lot of companies will just run some audit software (Like IBM rational AppScan), send you the results and then answer any questions (the results usually define how to fix any issues anyway). Note. I may of just experienced a few average companies.

Personally I would rather save my money and run audit software in-house. Here is a list of reviewed security audit software you may wish to look into if you ever want to run in-house auditing. However, for someone with limited security background this may not be the best option (although you would learn a lot).

Before committing ask around, do some research on each potential auditor and compare them to one another. This should help you weed out any average companies.

Goodluck.

Answer 2

You have some good indicators in some areas:

In the UK, being a CREST approved company means your methodology meets the Council of Registered Ethical Security Testers requirements, and having CREST application or infrastructure testers is a 'gold standard'

Also in the UK, CHECK provides similar assurance, but is more tailored for the public sector.

Other than that, you can go for track record:

In most of the areas I work, the known companies/teams/individuals are the ones in demand and the value behind them is in their name and reputation. This is why a lot of work comes my way - people know me and know the teams I manage (disclaimer, I work for one of the Big-4 accountancy firms, and previously worked with one of the others, so have had large teams in a wide range of clients - which helps for visibility)

For small or low risk security audits you can automate in-house scanning, using one of the known branded tools, but for anything more major you need to be able to tailor the results to your specific business needs. Which is where the big security audit firms come into their own, providing that business or operational risk analysis, rather than just a set of technical results.

Answer 3

I'd say how you would find a good provider depends on your goals for doing it. If you need to prove some kind of compliance or ensure you can pass an audit then I'd say go with a provider who has experience with the criteria you need to pass. If your goal is security improvement rather than compliance then your best bet is to go with recommendations if you can get them, and if not bring in several candidate companies for an interview. Give them one of your web servers to do a scan and tell them to bring the sample results.

Some will bring you canned results which are just output from some automated tool where they obviously haven't given it a second glance. Their results may have have obvious false positives like saying that there are linux vulnerabilities which aren't applicable to your system, or vulnerabilities for software that isn't present on the system. There may be some filler around ICMP to bulk it out. Good ones will have used the results as a jumping off point to dig for further results. They will have filtered out the false positives and useless entries and done further exploration into your systems.

I don't recommend you do it yourself unless you have a great deal of background in it.

Answer 4

You can consider company to be AAA+++ if they do publish their processes on their website :P E.g. they tell that they do training first, then design, integration, validation and how they handle the release, like certification etc.

Answer 5

Even reputable companies sometimes give useless or counter-productive feedback; many times it comes down to the experience of the actual representative you talk to. Just search this site for questions dealing with PCI-compliance audits to get an idea of how perfectly backwards some well-established firms can be.

But in the end, what you really need isn't an audit, it's training. An audit is just a snapshot, and it's value disappears almost immediately. But if you can get a firm to act not as an auditor but as a consultant, training you in the proper way to secure your business, then you'll have something of lasting value.

Also, consultants are much easier for you to rate. If you're not learning anything useful from your consultant, then clearly he isn't very good. Try out a few and decide whose style you like, and compare their advice with what you see on this site. It should be pretty straight-forward if you put a little time in to it.