I work for a company that has done in house application development (for our internal systems) since its inception decades ago. Recently, however, the rise of APIs and real-time data transfer has finally come to the attention of the higher-ups. Previously all data exchange has been through FTP file transfers and moving to use newly created APIs that could open up a hole in our defenses has prompted the need for an InfoSec consultation.
We have got in contact with a few firms but the requirements set down by us don't seem to be met by any and it reached the point where I needed to reach out and ask you whether this list of requirements is commonplace or very uncommon and whether we should consider amending our requirements.
Here's a rough summary of what we have asked of our InfoSec consultation:
- Provide guidance on best practices for infrastructure, such as server/firewall config, logging, intrusion detection, etc.
- Secure coding best practices
The second item on the list is what all the companies we have contacted have failed to meet.
Is secure coding something that is common for people to consult on as they would provide infrastructure security consultations or is this something that is more often than not left up to us developers to gain particular credentials in?
I'm finding very little information around this issue and the one firm I have found that looks like they fit the bill is based in Iceland! (I'm in the UK by the way.)