1

We have a website, and somebody wrote us an email claiming we are insecure!

What should I do

10

Stay calm, and be nice to the person reporting this. If they are contacting you, they only want to help, so do not threaten them.

Also don't ignore them, make sure they understand that you are interested in fixing this. Explain to them that you need time to do this; ideally you can give them a time frame in which you think that you can have this fixed (right now, it does not seem that you can estimate this, but keep this in mind for future incidents).

If you do not fully understand what they are telling you, you can ask for clarification and a proof of concept (although make sure to formulate it in a way that does not sound demanding. Depending on the country they are in, this might cause them legal trouble).

If you do not have developers who can fix this, either hire someone external or have your developers read up on common security issues and how to fix them (especially SQL injection) for the language (and/or platform, software, libraries, etc) that you use.

2

First thing is to follow Tim's advice with regard to responding to your contact. If it isn't clear what the nature of the problem is it would be worth asking them for more information as they appear to be interested in helping.

I suspect since you are asking here you don't have access to developers with experience of secure development or an IT department to fall back on? This leaves you the options of getting in external expertise, or if that isn't an option, your developer (you?) trying to get up to speed.

If you know the nature of the issue follow the link to the OWASP top 10 below and brush up. If it's not on the list it's probably worth posting another question. Otherwise start at the top of the list and work through them I turn determining if they could be the cause.

Suggest you start reading on OWASP for general information: https://www.owasp.org/

The most common issues in my experience are: XSS, Sql injections, lack of encryption, poor hanlding of authentication, sessions and authorisation.

You can find the OWASP top 10 here: https://www.owasp.org/index.php/Top_10_2013-Release_Notes

-2

I think just an URL is not good enough to prove that your site is insecure(in most cases).

I assume that you might know neither the security architecture nor the functionality of your site, i suggest you to take things(reported URL) to your IT department. It would be great if they are able to identify the problem.

If not ask that critic for more information(defending your security at the same time getting the info they have got as a base) and pass it on to your team. If they identify that it is a security problem, then ask them to start working on the fix. Update the critic that you are fixing it. And don't forget to thank him for letting you know!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.