Is this question in scope: how to select a security firm/consultant

Question

I'm toying with the idea of asking a question that isn't exactly technical: how does an IT specialist who is NOT an expert in security select a security company or consultant for, say, a pentest or a security code review.

This came after I had to review the offer from several security companies: I realized that, while I (hopefully) was able to navigate through the offers and all the gibberish that was thrown at me, I would probably would have been quite lost if I didn't already have some background in security.

Having already had suggested to several customers of ours (most of them small companies) that they hire a security expert for a job or another, I realized that none of them would have been equipped to select through these offers in an efficient way.

therefore, I wonder if some kind of open question could help shed some light on what things one should be looking for, what to ask, what to expect (and maybe, what type of answer to run from).

Answer 1

Might be too broad to answer in a Q&A format: there are different things to look for depending on what your requirements are.

For example, if you need incident response support (your server has been compromised and you need to identify what data they may have accessed for reporting to the regulator), you need a very different skill set to getting a vulnerability scan of your network of 10,000 PCs, or when you need a threat model for your new fintech startup, or when you need your AES integration verified. There are companies that can do all of these, but they are rare, while finding a company that can do one of them is comparatively simple.

Answer 2

I agree with @Matthew, different types of "security consultant" could have radically different answers. So I would suggest narrowing it a bit, to what exactly you are referring to.

E.g. I don't mean "Java expert" vs "C++ expert", but as he said - e.g. incident response vs network scan vs appsec, and also e.g. one-off compliance scan vs ongoing architecture partnership.

I'm sure there would be still be a lot in common though, so it may be tricky to find the right balance, but otherwise it would be too generic.

But otherwise your focus - what to be looking for, what to ask, what to expect, what answer to run from - is great, and makes it very much ontopic.
Just make sure to emphasize NOT to respond with referrals or suggestions :-)

Answer 3

In general security is based on a chain of trust.

Proving someone's hacking skills could be difficult, but some companies like Offensive Security are quite succeed on that. So you, in turn, can trust their OSCP/OSCE certification of a person. Or you can refer to their approved public research results, or CVEs.

When somebody claims himself as a security consultant you can track his records down to the list of companies he worked for and look for evidences of possible security incidents and their processing related.