Can I ask a high-level / overview question?

Question

I'm wondering whether it would be OK to ask the following question on this site; whether I should modify it some way to make it better, before I ask it; and/or whether it would be better to ask this on another site, e.g. webmasters.SE.

---

Title: Checklist for a VP licensing a web application?

My situation is as follows:

• Me: I'm a software developer (not a security specialist). I'm working for/with a startup. I'm the most technical (and/or only technical) person in the startup.

• Web application: I have written a web application using ASP.NET. Currently, users login with username and password. Data is stored in an SQL database and managed via the "ASP Membership Provider" framework (which hashes passwords, generates session cookies, etc.). The application is configured to only support SSL (i.e. HTTPS).

• Web host: The application is is hosted on a commercial web host (using IIS, MS SQL, etc). The host have their own data centre (hardware and building). This web host also offers another solution, i.e. they resell and manage hosting on Microsoft Azure cloud, which I may switch to presently. It's "managed" hosting, so their job to keep system software and patches up to date.

• Customers: The application is intended for corporations and/or government agencies (not consumers). Customers use it to create, store, edit, and share operations data, including information about their physical assets (buildings) and their employees, the information including geolocation and other security-sensitive information.

• Threat: Theft of customer data could help terrorists' planning, and/or help thieves to steal customer's valuables.

My question is as follows.

Any potential customer, i.e. the VP of IT (or the CIO or similar), who considers buying licenses for this application, is likely to want to know about its security. "If we use this application, will my data be secure?"

• What questions (about security) are they likely to ask?
• Is there a check-list or something of security-related questions I should consider?
• Is there anything (of finite length) I can read, to kind of get up to speed on this topic?
• What should I do, to satisfy my own conscience that I've been diligent in considering the security of customers' data?

In summary:

• What do/can you look for, security-wise, when you use a web application that's developed and run by a small vendor (i.e. not an application which you develop yourself in-house, nor an application developed by a large vendor)?

Answer 1

It does look sensible as a question, until the question itself. You did some research and you summarized it, that's very good.

But then you start asking things that are completely subjective. No one can really tell what a customer will ask you, for the simple reason that the customer may have a wide range of awareness of information security issues. Moreover, asking for a recommendation (of something to read) that will make you an expert is off-topic on the site.

Finally the checklist approach you cite is actually your nemesis, which explains why you believe in asking the question that way. One of the biggest reasons there are so many security flaws in software/hardware is the checklist approach. You need to change that approach into understanding to be able to perform well against all the issues you enumerate.

Understanding does not mean being an information security expert. No one (well, probably almost no-one) can be an expert in all aspects of InfoSec, going from cold boot attacks, to watermarking encryption, to XSS, to ALSR workarounds. You only need the understanding of the issue you face, and then of how computers work around that. You already did part of it by analyzing that Azure managed hosting will provide you with SaaS instead of plain IaaS, and that way you have a couple of issues less to worry.

(The security of Azure cloud may not be perfect, none is, but it is likely to be better than what can be done single-handedly in a limited timeframe.)

---

Objectively, modify your question to ask about the issues through which the data can be accessed in a networked application (I assume it is a networked application):

• OWASP top 10 has several network vulnerabilities
• will you use CORS?
• XSS is always there, and very dangerous
• You say HTTPS, but what about HSTS?

And last but not least your hosting provider always has full access to the data.

Next you will need to find the weakest link of all of those (maybe discounting the hosting provider since that is their liability really), and ask the question on whether that is really the weakest link. And, moreover, what would be the best mitigation.

When you can build the question you will not have to worry about questions a customer may make (unless they're particularly clueless) and not rely on checklists. Your question will be able to fit into the "satisfy my conscience" part, you cite, in leaving someone's sensitive data private.

Extra note: Given that you plan to be a small software vendor of products that may be run by government agencies, and that process sensitive data, you do need a lot of information security awareness. Making a mistake in that area has huge repercussions (and often also liability). A checklist approach to that is extremely dangerous in that situation, and I would highly advise against it.