Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking for in an auditor? What qualifications should he/they have, and how can I verify them?

share|improve this question
2  
Just to be clear, is there a specific kind of security audit you need? For example for PCI compliance or something else? –  RandomBen Dec 15 '11 at 14:58
    
I'm looking for something general -- I'm a solo developer and don't have anyone to review my code, but even if I did, I'd still want someone who knows more about security to bang on things. I know enough (I think) to prevent SQL injection attacks, but I don't know what else I need to be worried about. Someone, somewhere, must specialize in this stuff. Who is he, how do I find him, and how do I tell if he's any good? –  J.T. Grimes Dec 15 '11 at 18:12

2 Answers 2

I'm going to suggest that you get yourself a copy of nessus and run the scans yourself. It should give you a good baseline to start with.

Why? Because many third party auditors are going to run this exact tool and won't really help you with interpreting the results any way.

If you use certain Verisign certificates, Symantec throws in some baseline vulnerability scanning as part of the cost. Other CAs may provide some of these services as well.

If you have a specific requirement like PCI Compliance, you can get a list of authorized scanning vendors with the caveat being that scanning results don't necessarily come with vulnerability management support (unless you pay extra).

share|improve this answer

There are IT security certificate issuing firms. I cant give a statement on the acceptance of those or on the skillset required.

Maybe a google search on "IT security certificates" reveals more information or a start for deeper DD.

A professional pentester/auditor should be able to prove the knowledge by such a certificate, a real diploma and/or job references.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.