What should be the questions asked to assess a company on web app security?

Our company is in process of partnering with another company in order to outsource web app security work to them. For us to make sure they would deliver the right assets, what questions, documents, or processes should be considered asking?

Also, the tests which they would likely do for us are black-box security assessments which include but is not limited to webapp security assessments, penetration tests, mitigation queries and answering any queries from the client if the clients does not necessarily understand the technical aspects of the security assessments conducted.

  • That's really going to depend on what you need from them. – schroeder Mar 9 '15 at 21:23
  • yes, and as mentioned above. We would like to just clarify the initial statements and get their skills ahead before our practical signatory association. This exercise would help us know what initially we could ask!? – Shritam Bhowmick Mar 9 '15 at 22:38
  • You have not given us nearly enough to work with. Are they doing testing? Coding? "Security work" is undefined in your question. – schroeder Mar 9 '15 at 22:53
  • Yes, I agree on that. They would be on vulnerability assessments and penetration tests. All of these tests would be black-box and would not be a white-box code audit. I'd change the 'security work' to something that suits the community. – Shritam Bhowmick Mar 9 '15 at 23:01
  • There are lots of good questionnaires online: pcicomplianceguide.org/… – schroeder Mar 9 '15 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.