1

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor?

As the vendor have source access of our web application in order to carry out penetration test there might be application level exploits which might be carried out later by the tested vendor,other than that what were the pre checks which we need to be carried out while handing our web application to security audit ?

Improve this question
6
  • If you are providing it for a pen test, then there is usually an agreement between you and the pen tester that the results of the test will not be disclosed to any one else. Sorry, I don't understand what you are worrying about?
    – ρss
    Jun 10, 2015 at 13:30
  • there would be agreement b/w us and vendor but other than fixing web application exploits should i take care of any other stuff before submitting application to the vendor@ρss
    – BlueBerry - Vignesh4303
    Jun 10, 2015 at 13:42
  • 2
    I have personally never provided my web app to any pentester. But as far as I think you don't need to hide something from the pentester, its better to tell them more about your application so that they can find as many security bugs as possible. (I am not saying that your web app should have many bugs.) Because the hacker will do the same once your web app is online.
    – ρss
    Jun 10, 2015 at 13:49
  • If you are really concerned you can not give source code. Pen testing is very effective without source.
    – Neil Smithline
    Jun 10, 2015 at 13:52
  • As a pentester I prefer to have the source code when testing the application. It's more efficient for me and for the client as you can better trace the logic behind the application. As a tester you will be able to identify vulnerabilities a lot faster.
    – Lucas Kauffman
    Jun 10, 2015 at 13:55

2 Answers 2

Reset to default
2

If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell out the expected outputs, the timeframes and methods they will communicate the results to you. All of these things are just ways to make sure you are getting exactly what you expect from them. This is in their best interest too; they want happy customers as well.

Aside from the legal/contractual matters you would be wise to give them an environment as close to or the same as your production one so that the findings are accurate and also if you can perform your own testing ahead of time to remove the "low hanging fruit"- that is, anything that is easy for them to find. Consider code reviews and system design reviews ahead of time to give them what you think is your best. That way you are getting your money's worth.

Improve this answer
2

If you're worried about giving your source code to a third party, then don't. Bring the third party on-site to perform the code review and don't permit them to take the source code away with them. This also means they can sit with a developer and have responses to any questions they have quite quickly. The developer will also have the opportunity to learn from the reviewer.

For the penetration testing, both credentialed and non-credentialed testing can be done without providing any source code as the tester can test the application interface and logic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .