InfoSec consultancy - infrastructure vs development

Question

I work for a company that has done in house application development (for our internal systems) since its inception decades ago. Recently, however, the rise of APIs and real-time data transfer has finally come to the attention of the higher-ups. Previously all data exchange has been through FTP file transfers and moving to use newly created APIs that could open up a hole in our defenses has prompted the need for an InfoSec consultation.

We have got in contact with a few firms but the requirements set down by us don't seem to be met by any and it reached the point where I needed to reach out and ask you whether this list of requirements is commonplace or very uncommon and whether we should consider amending our requirements.

Here's a rough summary of what we have asked of our InfoSec consultation:

• Provide guidance on best practices for infrastructure, such as server/firewall config, logging, intrusion detection, etc.
• Secure coding best practices

The second item on the list is what all the companies we have contacted have failed to meet.

Is secure coding something that is common for people to consult on as they would provide infrastructure security consultations or is this something that is more often than not left up to us developers to gain particular credentials in?

I'm finding very little information around this issue and the one firm I have found that looks like they fit the bill is based in Iceland! (I'm in the UK by the way.)

Answer 1

"Secure coding best practices" is not a typical thing to get a consult on and is a little like asking "how not to get sick". It's a pretty broad mandate. It is so context-dependent that I'm not sure how a consultancy could satisfy the mandate as specified.

One typically gets trained in a specific language's secure coding best practices and in a specific use-case (API development). And once you niche down the problem-space, the answers tend to reveal themselves.