What is the best way to get a third party audit done of website security?

Question

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and does individual projects will look at the source code and will also do penetration tests, etc.

Now while it will make me feel comfortable that somebody who is well-versed with it will be scanning the site and making necessary changes if need be but i am uncomfortable with the fact that that one person will know how we code things and how we process things.

Now i have two options, either i let him test the site on our website that we need it for or i move the site to another domain and call it something else. But I also want him to sign a NDA agreement which will then have to have my company's name on it. So i am sort of lost?

How does one allow third party audits without being vulnerable to them?

Answer 1

I'd echo what the other answers have said in that what you're describing is a fairly standard security review process and if done properly you shouldn't have much to worry about in terms of the audit company having access to your data.

A couple of points which may be of use

• In choosing the company if there are any well-known industry bodies, you could consider using an accredited provider (eg, in the UK there's CREST ). as @D.W. says, testing companies are professional organisations and even an accusation of misusing customer data would be bad for them, so I'd expect most to be very careful with that side of things.
• Contracts and NDAs should be in place between your companies. Part of that would of course include a requirement that they don't misuse any data from the test.
• One point you mentioned about the auditing company making changes to your site. Usually a security testing firm would just report results and make recommendations for change rather than actually altering a live system, and I'd say that's a good approach. The audit company won't have a complete knowledge of your systems, so it could be risky for them to make changes to them.

Answer 2

I think your fears are overblown. My recommendation is to choose a third-party auditor you trust and give them full access to your site (your code, everything). Sure, have them sign a NDA, that's entirely reasonable. But be realistic: they're not going to steal your IP. They're professionals, and their career and their business relies upon trust; they would be crazy to steal one person's IP. And, odds are, your site's code isn't worth that much to anyone anyway. There is no need to try to conceal your company's name, to move your domain, or to limit their access to your site and your code.

Answer 3

For an accurate penetration test / security assessment and code review the context of the website need to be known and will help identify what may be the vulnerabilities. If are you are not open with these details the assessment may not find everything.

Promote it

Going through a security assessment is nothing to be ashamed of, it is standard practise and promoted as a positive by many companies. It is more important what you do with the results.

Confidentiality

You are right you will want them to sign a deed of confidentiality, non-disclose agreement (NDA) or other contract. Most reputable security firms take this very seriously, however if you are concerned then you should state in the contract how the information and the report will be handled. Such as the report and any data collected is not permitted to leave your site.

Use a test but fully functional version

A security assessment can bring a web site down or break functionality depending on what vulnerabilities are found (there is always something). I would suggest that you have a test site with sample/test data that it configured as close to the real one as possible.

Hope this helps.