I'm wondering whether it would be OK to ask the following question on this site; whether I should modify it some way to make it better, before I ask it; and/or whether it would be better to ask this on another site, e.g. webmasters.SE.
Title: Checklist for a VP licensing a web application?
My situation is as follows:
Me: I'm a software developer (not a security specialist). I'm working for/with a startup. I'm the most technical (and/or only technical) person in the startup.
Web application: I have written a web application using ASP.NET. Currently, users login with username and password. Data is stored in an SQL database and managed via the "ASP Membership Provider" framework (which hashes passwords, generates session cookies, etc.). The application is configured to only support SSL (i.e. HTTPS).
Web host: The application is is hosted on a commercial web host (using IIS, MS SQL, etc). The host have their own data centre (hardware and building). This web host also offers another solution, i.e. they resell and manage hosting on Microsoft Azure cloud, which I may switch to presently. It's "managed" hosting, so their job to keep system software and patches up to date.
Customers: The application is intended for corporations and/or government agencies (not consumers). Customers use it to create, store, edit, and share operations data, including information about their physical assets (buildings) and their employees, the information including geolocation and other security-sensitive information.
Threat: Theft of customer data could help terrorists' planning, and/or help thieves to steal customer's valuables.
My question is as follows.
Any potential customer, i.e. the VP of IT (or the CIO or similar), who considers buying licenses for this application, is likely to want to know about its security. "If we use this application, will my data be secure?"
- What questions (about security) are they likely to ask?
- Is there a check-list or something of security-related questions I should consider?
- Is there anything (of finite length) I can read, to kind of get up to speed on this topic?
- What should I do, to satisfy my own conscience that I've been diligent in considering the security of customers' data?
- What do/can you look for, security-wise, when you use a web application that's developed and run by a small vendor (i.e. not an application which you develop yourself in-house, nor an application developed by a large vendor)?