up vote 4 down vote favorite
share [g+] share [fb]

I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking for in an auditor? What qualifications should he/they have, and how can I verify them?

link|improve this question
2  
Just to be clear, is there a specific kind of security audit you need? For example for PCI compliance or something else? – RandomBen♦ Dec 15 '11 at 14:58
I'm looking for something general -- I'm a solo developer and don't have anyone to review my code, but even if I did, I'd still want someone who knows more about security to bang on things. I know enough (I think) to prevent SQL injection attacks, but I don't know what else I need to be worried about. Someone, somewhere, must specialize in this stuff. Who is he, how do I find him, and how do I tell if he's any good? – Boofus McGoofus Dec 15 '11 at 18:12
feedback

1 Answer

up vote 1 down vote

I'm going to suggest that you get yourself a copy of nessus and run the scans yourself. It should give you a good baseline to start with.

Why? Because many third party auditors are going to run this exact tool and won't really help you with interpreting the results any way.

If you use certain Verisign certificates, Symantec throws in some baseline vulnerability scanning as part of the cost. Other CAs may provide some of these services as well.

If you have a specific requirement like PCI Compliance, you can get a list of authorized scanning vendors with the caveat being that scanning results don't necessarily come with vulnerability management support (unless you pay extra).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.