1

I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with static and dynamic scanning pipelines created.

  1. Is this a common practice where full, unrestricted access to proprietary software source code is given to a 3rd party for the sake of security testing? It seems the opposite of secure when it comes to protecting your intellectual property.
  2. What precautions, if any, should be taken when entering a source code review with a 3rd party?

NOTE: I'm not sure if this matters, but the 3rd party being considered for the security test is based in the US, but the employees doing the work are located in another country.

1 Answer 1

2
  1. Is this a common practice where full, unrestricted access to proprietary software source code is given to a 3rd party for the sake of security testing?

I would say yes, but with a couple of footnotes.

It's common these days to expect a vendor to do SAST and DAST scanning of their products. In my experience, most 3rd party partners are happy to accept attestation that SAST and DAST testing is part of your routine software development lifecycle (SDLC), you address any Critical and High as part of each release. etc. This duty is typically performed either by developers or by an internal appsec team. If you don't have that as part of your internal SDLC process, then your only other option is to hire an outside company to do it as a one-off security assessment.

So IMHO intellectual property concerns is not a valid a reason for not doing security testing on your products; you have the option of buying the tools and doing the scans internally.

  1. It seems the opposite of secure when it comes to protecting your intellectual property. What precautions, if any, should be taken when entering a source code review with a 3rd party?

Any professional security testing company will be used to working with their customers' intellectual property -- and heaven forbid they find a real vulnerability in your product or accidentally get their hands on data they shouldn't have during the course of their security testing. That's all normal for a security testing company.

Make sure you have a good Non-Disclosure Agreement (NDA) in place with them -- the sec company probably has an NDA template, have it reviewed by your own legal team.

Make sure the security testing contract lays out the scope of the security test (what they are and are not allowed to test, for example list IP addresses and ports that are in-scope and that the rest of your network is out of scope). You could also put in contract language about how to handle vulnerabilities or data that they discover.

1
  • 1
    Thank you for the in-depth response! It is incredibly helpful to get feedback from someone with more experience. I will take your advice about adding the language how to handle vulnerabilities and data. Commented Oct 29, 2020 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .