Help me find the right Security Consultant for the stage our organization is in

Question

We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the backend. Both the backend and the SaaS-based offering are being marketed to enterprise prospects.

We adhere to security best practices but obviously we need independent verification and scrutiny if we are going to satisfy some of these large prospects. Eventually we will probably adopt some framework (COBIT, ISO 27001, etc.) once we can make some additional hires, segregate duties, etc. but for now we would like to improve our SDLC and submit our web applications to third-party penetration testing.

We have been trying to avoid the big accounting firms and big technology vendors (e.g. IBM) in the belief that they will be expensive and not in very good alignment with our organization. I guess I would call these "Tier I" consultants for lack of a better term.

We have tried what I'd guess I would call a "Tier II" firm (i.e. their personnel have come from a Tier I firm and provide similar services but are more affordable) but their experience seemed highly influenced by servicing companies seeking SOX compliance, etc. and the approach didn't seem like it was in good alignment with our need to prioritize our security expenditure.

I have tried to get in touch with other Tier II consultants but they seem to have their own issues (i.e. personnel leaving, don't get back to me in a timely fashion, don't really probe to see how they can best service our needs, etc.).

I am a bit reluctant to seek a sole proprietor or smallish company (call this Tier III I guess) as we want to leverage a name a little bit if we can and partner with someone that can provide some continuity of service and resources in a timely manner. No, "Sorry, I'm fully engaged right now, call me back in a month."

Which leads me to my conundrum/question: What kind of Security Consultant would you recommend for a small company that: 1) has a fairly complex web application; 2) markets its products and services towards enterprise prospects; and 3) needs to prioritize its security expenditure?

I should also state that I was trying to find someone with feet on the street in my neck of the woods so that we could meet face-to-face. I'm wondering how important a factor you think that is for this type of engagement.

TIA

Answer 1

Not mentioned, but exceedingly valuable - references:

Do you have other companies in your industry you could talk to to find out who they use, and how satisfied they are with the service?

I understand if you are in a specific niche, this might mean going to competitors to ask their opinion, but there is a very good argument which says that companies should pull together to secure their industry, and I believe that joining forces to share security best practices and information should not be a competitive distinction (unless you are in the security industry) but should help you both.

Answer 2

Here's some background on the players:

• CPA firms. Financial-world focused, they deal with CFOs and regulatory questions. Typically less technical in exchange for more business knowledge and being able to sign off on assurance engagements. Depending on the field you're in, other companies might not play with you if you don't have a letter from one of these. Because of their basic financial assurance, they are also found playing strong in other assurance fields like HIPAA.

  • The big 4 (down from 8) KPMG, Ernst & Young, PwC, Deloitte Touche. They all have specialist departments focused on IT. Their strength is in great depth and they can call up from around the world. Big doesn't necessarily mean better -- it's a price trade-off. you're paying extra for the insurance of somebody who "cannot fail". I've seen some signs otherwise, but maybe that's personal bitterness: http://www.healthcareitnews.com/news/maine-inks-179m-deal-medicaid-management Go here if your company is so large that you need more than 10 staff to get through your engagement.
  • The regional players: There are many, and they're filled with people who will go to the big firms or who came from them. Since Sarbanes-Oxley's independence rules, they get a bigger share of the pie. I work for one of the regional players, and regionals play in the Fortune 500 game. Go here if you're looking for expertise at a lower cost than a Big-5 and won't need enough feet on the ground to trample you. Beware that not all of them have deep technical knowledge. Most of them should have appropriate connections to other firms for specific parts of projects. (Say you're in Seattle - I might show up there once or twice, but if I need a lot of hands-on I might send somebody from another firm as part of a network). Shameless promotional pitch: http://bnncpa.com/

• Boutique firms Specifically dedicated to IT, they may be useful for better internal development. Some industries will take assurances from a boutique as an outside vendor.

  • National / International firms Sourcefire, Rapid7 and IOActive fall into this category. They're probably closer in staffing to a larger regional CPA firm. Their customers are technology companies or suitably large IT departments.
  • Local players The rest of the world fills out this. Smaller shops that cover a specific region and have a more narrow field of experience. Their people probably are more generalized in their experience.

One really good way to get an idea of what's in your area is to take a look at your regional conferences for ISACA. In my case, http://www.isacane.org/events_detail.php?select=257 has a list of players form all of the above categories except the regional CPAs (boy, somebody dropped the ball there?). Besides that, you might also find actual specific recommendations if you poke around this site's chat room.

Answer 3

Contact an industry analyst group, such as Forrester or The 451 Group. I used to also like The Burton Group, but they were acquired by Gartner. I like Gartner, but it's good to get a balanced/neutral view and I think they (like the other large organizations) become more narrow-minded towards products from major vendors.

A similar thing exists between OWASP and WASC. OWASP provides balanced/neutral advice, while WASC is an organization that is focused on providing product-specific advice for the vendor companies that support it. OWASP has company members/sponsors, but they do not comment on which sponsors are better or more quality than any others.