3

Is it reasonable to refuse to guarantee that you will find 100% of security issues when doing a vulnerability assessment on a website?

Even with companies like Google that have teams of security professionals, an occasional security vulnerability slips through. There are also zero day security issues with third party software that are not realistically findable when doing a vulnerability assessment.

Considering the above, what is a reasonable position to take when doing a vulnerability assessment regarding finding all security vulnerabilities?

Improve this question

1 Answer 1

Reset to default
4

From the InfoSec perspective it's perfectly reasonable. No surgeon can (or should!) guarantee a 100% safe operation, no lawyer can guarantee conviction or acquittal.

Of course, the customer doesn't want the InfoSec professional to take their money and hide behind that clause in their contract either, if something were to slip past the audit.

I'd suggest that the solution to the issue is exactly what you mentioned - setting the right expectation. The customer should expect that the InfoSec team will do their very very best to detect common, easily exploited vulnerabilities. There are many ways to signal that you truly intend to do your best.

  1. Financial guarantees specific to the scope of the audit request: e.g. 100% refund for a SQL injection exploited post-audit.

  2. Reputational guarantees: e.g. "Secured by ACME InfoSec" text on their website, so that the InfoSec professional has a vested interest in keeping the site secure.

  3. Multiple-audit guarantees: e.g. Offer to have a competing InfoSec firm provide a second opinion for comparison.

  4. Testimony: From other customers whom you have helped in the past.

  5. Proof of Work: Demonstrate actual effectiveness of your recommendations. e.g. Have independent pen-testers attack before and after your recommendations are implemented.

Of course, this all depends on a customer that understands that the only certainties in life are death and taxes.

For those that insist on 100% guarantees, you could certainly provide those within scope (point #1 above). You could (and should) include a maximum liability clause - e.g. the most that you will have to pay is $x.

Improve this answer
1
  • +1 for the reputation guarantee suggestion. If this is adopted on a wider scale, it will make the penetration testing vendor publicly accountable because they can't then just run an automated scanner and give the report. We might have an online service then where you can search what sites are secured by which vendor to get an idea about the type of work they have done previously.
    – void_in
    Commented Oct 11, 2013 at 7:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .