As an exercise, please consider the following:
If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques or technologies would be worthwhile applying or deploying for some protection?
Assuming the following:
- You don't have access to the source code or can't easily influence changes.
- You don't have the resources, funds or skills, for penetration testing or vulnerability assessment of individual applications but funds maybe available for protection technologies that could be used across a range of web applications.
- You have no ability to veto the deployment of the applications.
Update: Think SysAdmin rather than InfoSec professional, that is you have some idea about security but it isn't your main thing.
What are the approaches, techniques or technologies that should be considered at the SysAdmin level without a Security Team to call on that would help them sleep better at night?