I work for a company that has done in house application development (for our internal systems) since its inception decades ago, recently however the rise of APIs and realtime data transfer has finally come to the attention of the higher ups. Previously all data exchange has been through ftp file transfers and moving to using newly created APIs that could open up a hole in our defenses has prompted the need for an InfoSec consultation. We have got in contact with a few firms but the requirements set down to us don't seem to be met by any and it reached the point where I needed to reach out and ask you guys whether this list of requirements is common place or very uncommon, and whether we should consider amending our requirements.

So here's a rough summary of what we have asked of our InfoSec consultation:

• Provide guidance on best practices for infrastructure, such as server/firewall config, logging, intrusion detection, etc.
• Secure coding best practices

The second item on the list is where all the companies we have contacted have failed to meet.

Is secure coding something that is common for people to consult on as they would infrastructure security consultations or is this something that is more often than not left up to us developers to gain particular credentials in? I'm finding very little information around this issue and the one firm I have found that looks like they fit the bill in based in Iceland! (I'm in the UK by the way.)

I work for a company that has done in house application development (for our internal systems) since its inception decades ago. Recently, however, the rise of APIs and real-time data transfer has finally come to the attention of the higher-ups. Previously all data exchange has been through FTP file transfers and moving to use newly created APIs that could open up a hole in our defenses has prompted the need for an InfoSec consultation. 

We have got in contact with a few firms but the requirements set down by us don't seem to be met by any and it reached the point where I needed to reach out and ask you whether this list of requirements is commonplace or very uncommon and whether we should consider amending our requirements.

Here's a rough summary of what we have asked of our InfoSec consultation:

• Provide guidance on best practices for infrastructure, such as server/firewall config, logging, intrusion detection, etc.
• Secure coding best practices

The second item on the list is what all the companies we have contacted have failed to meet.

Is secure coding something that is common for people to consult on as they would provide infrastructure security consultations or is this something that is more often than not left up to us developers to gain particular credentials in? 

I'm finding very little information around this issue and the one firm I have found that looks like they fit the bill is based in Iceland! (I'm in the UK by the way.)

I work for a company that has done in house application development (for our internal systems) since its inception decades ago, recently however the rise of apis and realtime data transfer has finally come to the attention of the higher ups. Previously all data exchange has been through ftp file transfers and moving to using newly created apis that could open up a hole in our defenses has prompted the need for an InfoSec consultation. We have got in contact with a few firms but the requirements set down to us don't seem to be met by any and it reached the point where I needed to reach out and ask you guys whether this list of requirements is common place or very uncommon, and whether we should consider ammending our requirements.

So here's a rough summary of what we have asked of our InfoSec consultation

• Provide guidance on best practices for infrastructure, such as server/firewall config, logging, intrusion detection, etc.
• Secure coding best practices

The second item on the list is where all the comapnies we have contacted have failed to meet.

Is secure coding something that is common for people to consult on as they would infrastructure security consultations or is this something that is more often than not left up to us developers to gain particular credentials in? Finding very little information around this issue and the one firm I have found that looks like they fit the bill in based in Iceland! (i'm in the UK by the way)

Thanks

I work for a company that has done in house application development (for our internal systems) since its inception decades ago, recently however the rise of APIs and realtime data transfer has finally come to the attention of the higher ups. Previously all data exchange has been through ftp file transfers and moving to using newly created APIs that could open up a hole in our defenses has prompted the need for an InfoSec consultation. We have got in contact with a few firms but the requirements set down to us don't seem to be met by any and it reached the point where I needed to reach out and ask you guys whether this list of requirements is common place or very uncommon, and whether we should consider amending our requirements.

So here's a rough summary of what we have asked of our InfoSec consultation:

• Provide guidance on best practices for infrastructure, such as server/firewall config, logging, intrusion detection, etc.
• Secure coding best practices

The second item on the list is where all the companies we have contacted have failed to meet.

Is secure coding something that is common for people to consult on as they would infrastructure security consultations or is this something that is more often than not left up to us developers to gain particular credentials in? I'm finding very little information around this issue and the one firm I have found that looks like they fit the bill in based in Iceland! (I'm in the UK by the way.)