Revision as of 05:00, 16 June 2010

4/11/2010 - Purpose of this project is to simply provide an objective list and a aggregate set of questions from companies to utilize when they issue a RFPs for web application security verification. The discussions for this project can be found here and to get more people involved TWEET IT

April 11th = Request for OWASP Volunteers RFC open
June 30th = Publish Version 1.0 - RC1 July 4th = Publish Version 1.0

SUGGESTED APPLICATION SECURITY VERIFICATION RFP QUESTIONS

Company Background

1. Brief overview of products and/or services offered?

2. How many years has your company been in business?

3. Describe your experience with applications of a similar size, scope, complexity, and vertical as the applications to be verified.

4. Describe your experience with the languages, frameworks, libraries, and other technologies that comprise the applications to be verified.

5. Describe your level of involvement in the application security community, in organizations such as OWASP and WASC.

6. Other relevant background information?

Application Security Verification Methodology

1. Describe your methodology for all the verification techniques to be used:

a) dynamic vulnerability scanning
b) static analysis
c) manual penetration testing
d) manual code review
e) threat modeling
f) security architecture review
g) malicious code analysis

2. Describe the steps required for your product or service to verify the security of an application?

3. If multiple techniques are used, how will they be used together in the verification effort?

4. Provide your thoughts on why performing this security verification is important to our organization.

5. Describe your interaction with software developers, security staff, and business owners during the verification process.

Security Coverage

1. Describe the vulnerability and security control coverage provided by your verification efforts with reference to the OWASP ASVS,WASC 24 Broad Classes of Attacks, and the OWASP Top 10

2. Describe the different levels of rigor that you offer for the verification effort. What are the differences in security coverage between these levels?

3. Are you currently able to test for Cross-Site Request Forgery (CSRF) and HTTP Response Splitting?

4. How can you ensure you will find all existing vulnerabilities?

5. What criteria are used to perform assessments?

6. Does your solution meet PCI 6.6 standards?

Application Coverage

1. How does your product/service baseline an application?

2. How do you tune your product/service to verify an application most effectively?

3. What methods do you use to ensure coverage of the entire application?

4. How do you verify with a customer that you are providing thorough coverage of the targeted application?

Risk Evaluation

1. Describe your process for determining the specific likelihood and business impact of vulnerabilities you discover.

2. How do you limit (or eliminate) the reporting of false positives?

3. Describe your approach for combining similar risks so that they can be easily understood and remediated.

Differentiators

1. What is the most challenging aspect of your verification efforts?

2. What about your approach is unique and why is that important to us?

Scope

1. Approximately how long does it take to implement your product/service?

2. Specifically, how does your solution scale for multiple websites?

3. How do you ensure you won't affect the performance of a publicly facing website during the testing process?

4. Does your product or service allow for on-demand / ad hoc testing?

Security

1. Describe exactly how you will protect our information, including all information about our application and any risks discovered, while it is in your custody. Please describe your network security, information storage security, and need-to-know processes.

2. Please provide information on the trustworthiness of individuals who will have access to our information as part of the verification.

3. Please describe how information necessary for the verification will be exchanged securely.

4. Please describe how our information will be purged from your systems when the verification is complete.

5. Please describe how our information is kept separate from the risk information of other customers.

6. Please provide evidence that your systems are secure against attack.

Burden

1. Describe any personnel costs on our side? How many personnel are needed? What are their skill sets and experience levels?

2. Are there in-house personnel costs that need to be factored in? If so, can you estimate how many hours should be allocated to internal resources? (as a reference point, use the amount of personnel time it would take to perform one application verification as an example).

3. Describe exactly what materials we will be expected to provide.

Reporting Interface

1. Describe exactly how risks will be written up, including:

a) title
b) location (URL and line of code)
c) specific vulnerability description
d) risk likelihood, business impact, and severity
e) code snippets
f) specific remediation recommendations

2.Describe how the risk model you use can be customized for our corporate standard.

3. Describe your reporting interface using criteria such as ease of use, clarity, comprehensiveness, how reporting components are organized, etc.

4. How does your product or service provide timely updates on any new web application risks identified? Are alerts delivered to authorized personnel? If so, how are they delivered and under what conditions?

5. Do you provide historical trending reports that track open/closed risks and the ongoing remediation process?

6. Can assessment reports be generated to reflect the risk status of individual web applications, as well as the security health of all web applications?

7. Can your reports be tailored and adapted for viewing by various levels of management, internal/external auditors, security specialists, etc.?

8. Does your solution provide an API so that risks can be exported into other applications, such as CRM apps, bug tracking systems, SIEMs? Are there any canned scripts or standard integrations that exist? With which applications?

9. Do your reports contain specific recommendations for application developers, tailored for the exact problem in the code?

10. How do you provide timely and reliable reporting of risks for ongoing visibility, measurement, and management?

11. How frequently do you provide enhancements to your reporting interface? What is the process?

12. How do developers know if they have successfully remediated a risk?

Innovation

1. Describe any recent innovations your company has introduced to lower costs or improve service for your customers.

2. How do you identify new vulnerabilities and test for them?

3. How are you able to uncover and test for new attack techniques that can be used to exploit known classes of risks?

4. How do you test new technologies (e.g. new versions of Flash) for risks?

Integration

1. How does your product/service compare to competitive offerings?

2. Does your product/service integrate with web application firewalls (WAFs)? Which ones and how does it work?

Benefits

1. How do you make the remediation process more efficient?

2. Describe the balance of internal and external resources in an ideal application security program.

3. Can you deliver accurate results and diminish/eliminate false positives, thus making the verification process more efficient?

4. Are you able to demonstrate a positive ROI and increased benefits to management? How?

5. Are you able to influence secure coding techniques / reduce time spent debugging? How?

6. Explain why we would realize a competitive advantage by doing business with your company?

Supporting Services

1. Describe any training or elearning options available to support the verification effort.

2. Do you offer remediation support to software development groups?

3. Is strategic consulting support available to support our application security program.

Customer Support

1. Can you describe the process in place whereby customers interact with your internal service and support? What are the escalation procedures?

2. Do you provide tracking of all trouble tickets that have been opened and are they tracked through resolution?

3. Do you offer any kind of Service Level Agreement?

Pricing/Licensing Options

1. Explain your pricing model.

2. What are the terms associated with your product or service? Can you include a sample Software License Agreement or Master Services Agreement template?

3. Are there other costs we should be made aware of? If consulting or training costs are involved, how do you charge for these services?

4. Do you have a training and support program --Walter Houser 20:14, 16 April 2010 (UTC) for your product or service? Is it required? If so, what is the typical amount of time and cost associated with training/education?

Customer References

1. Please provide three references for comparable customers - similar size, vertical, technology, and verification effort.

Project Details