3

I'm wondering whether it would be OK to ask the following question on this site; whether I should modify it some way to make it better, before I ask it; and/or whether it would be better to ask this on another site, e.g. webmasters.SE.


Title: Checklist for a VP licensing a web application?

My situation is as follows:

  • Me: I'm a software developer (not a security specialist). I'm working for/with a startup. I'm the most technical (and/or only technical) person in the startup.

  • Web application: I have written a web application using ASP.NET. Currently, users login with username and password. Data is stored in an SQL database and managed via the "ASP Membership Provider" framework (which hashes passwords, generates session cookies, etc.). The application is configured to only support SSL (i.e. HTTPS).

  • Web host: The application is is hosted on a commercial web host (using IIS, MS SQL, etc). The host have their own data centre (hardware and building). This web host also offers another solution, i.e. they resell and manage hosting on Microsoft Azure cloud, which I may switch to presently. It's "managed" hosting, so their job to keep system software and patches up to date.

  • Customers: The application is intended for corporations and/or government agencies (not consumers). Customers use it to create, store, edit, and share operations data, including information about their physical assets (buildings) and their employees, the information including geolocation and other security-sensitive information.

  • Threat: Theft of customer data could help terrorists' planning, and/or help thieves to steal customer's valuables.

My question is as follows.

Any potential customer, i.e. the VP of IT (or the CIO or similar), who considers buying licenses for this application, is likely to want to know about its security. "If we use this application, will my data be secure?"

  • What questions (about security) are they likely to ask?
  • Is there a check-list or something of security-related questions I should consider?
  • Is there anything (of finite length) I can read, to kind of get up to speed on this topic?
  • What should I do, to satisfy my own conscience that I've been diligent in considering the security of customers' data?

In summary:

  • What do/can you look for, security-wise, when you use a web application that's developed and run by a small vendor (i.e. not an application which you develop yourself in-house, nor an application developed by a large vendor)?
2

It does look sensible as a question, until the question itself. You did some research and you summarized it, that's very good.

But then you start asking things that are completely subjective. No one can really tell what a customer will ask you, for the simple reason that the customer may have a wide range of awareness of information security issues. Moreover, asking for a recommendation (of something to read) that will make you an expert is off-topic on the site.

Finally the checklist approach you cite is actually your nemesis, which explains why you believe in asking the question that way. One of the biggest reasons there are so many security flaws in software/hardware is the checklist approach. You need to change that approach into understanding to be able to perform well against all the issues you enumerate.

Understanding does not mean being an information security expert. No one (well, probably almost no-one) can be an expert in all aspects of InfoSec, going from cold boot attacks, to watermarking encryption, to XSS, to ALSR workarounds. You only need the understanding of the issue you face, and then of how computers work around that. You already did part of it by analyzing that Azure managed hosting will provide you with SaaS instead of plain IaaS, and that way you have a couple of issues less to worry.

(The security of Azure cloud may not be perfect, none is, but it is likely to be better than what can be done single-handedly in a limited timeframe.)


Objectively, modify your question to ask about the issues through which the data can be accessed in a networked application (I assume it is a networked application):

And last but not least your hosting provider always has full access to the data.

Next you will need to find the weakest link of all of those (maybe discounting the hosting provider since that is their liability really), and ask the question on whether that is really the weakest link. And, moreover, what would be the best mitigation.

When you can build the question you will not have to worry about questions a customer may make (unless they're particularly clueless) and not rely on checklists. Your question will be able to fit into the "satisfy my conscience" part, you cite, in leaving someone's sensitive data private.

Extra note: Given that you plan to be a small software vendor of products that may be run by government agencies, and that process sensitive data, you do need a lot of information security awareness. Making a mistake in that area has huge repercussions (and often also liability). A checklist approach to that is extremely dangerous in that situation, and I would highly advise against it.

  • Thanks for your answer and I kind of agree with you (which is why ask this on Meta first). As a software developer I kind of know about CORS and XSS and so on: i.e. technology; but I imagined that a VP or CIO might have a higher-level view, or topics I haven't considered, perhaps something about "operations" or, I don't know, governance, or how to vet a vendor. What about my final question i.e. the "summary": i.e. "how do you evaluate the security of a web application which you buy/license from a vendor?" Is that an ask-able question, which might net me any informative answers? – ChrisW Oct 21 '16 at 13:53
  • 1
    @ChrisW - If someone is very worried about security he often asks for an audit. Some industries have well defined audits (e.g. PCI-DSS), others simply perform an audit by contracting a pentester. Actually, describing the industry (as you already so) and argue that you are thinking of contracting a pentester and then ask: "what I should ask the pentester to test" (and give examples of what to test and what not to test). That would make a pretty good question in my opinion. – grochmal Oct 21 '16 at 14:03
  • Also, thank you for the links you posted. The first is a checklist (!). So that actually starts to answer the question, so maybe it's a pity that that's not on the main site, instead of here on Meta. Something I didn't understand about the meta-answer: you said, "modify your question to ask about the issues", but I don't know how to parse/unpack that suggestion. Could you give me an example? Were you suggesting I list many specific issues/details (as you did), including e.g. XSS, and then ask about those details either individually (each in a separate question) or collectively? – ChrisW Oct 21 '16 at 14:08
  • @ChrisW - whelp yeah, but don't use that as a checklist, harhar. As for "modify the question" I certainly meant no here on Meta, but before posting to the site itself. I'll argue that you have two viable question paths now: "I believe that the weakest link of my application is X, right?" AND "I want to audit my app with a pentester, what I ask him to do?" (of course with some description in each). Posting two questions at the same time is often frowned upon because a question requires attention, therefore i'll suggest posting one and decide if the other is needed based on an answer. – grochmal Oct 21 '16 at 14:21
  • 1
    @ChrisW You may have already looked at the OWASP site, but even if so let me commend it to you again as a fine source. The link to their "Top Ten" list of web app security failings is linked to above by grochmal. But taking a look at their reference materials more broadly will provide you with a ton of good information. And you might find their Application Security Verification Standard Project doc useful as one better-than-a-checklist source of guidance. The 3.1 version of their guide is here: owasp.org/images/3/33/… – mostlyinformed Oct 24 '16 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .