Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have an authentication system(ASP.Net library) that I want to make sure is secure. What companies/resources can I use to make sure of this? Also, what should I make sure to do before sending it off to be "broken"?

A bit more background: Basically, I'm wanting to make a little bit of money by selling this system, but I don't have a whole lot to invest in it(USD $100-$200). I'm wanting to make sure I'm selling something secure, and that buyers know it's secure. I personally have looked over the code multiple times just staring trying to find a security flaw and cannot find one. This is of course not to say there isn't one. This is where I want to pay someone to come in and look at my code and how it all works and basically tell me if it's secure or not

share|improve this question
    
Paying somebody $200 to look at your code isn't going to get you much. That's maybe two hours of a competent person's time. –  David Thornley May 16 '11 at 21:58

2 Answers 2

up vote 1 down vote accepted

The best way to address security is education and planning. Either way you, or the product owner, are going to have the final say on if your application is secure enough or not. Here is what I suggest you focus on:

  • Know what threats or attacks you would like to guard against. Here are some great resources to help with this: http://wiki.asp.net/page.aspx/47/threat-modeling/ (The important thing here is to be reasonable with your expectations)
  • Educate yourself on best practices for guarding against things like cross-site scripting, sql injection, session hijacking.
  • Put together a check list of what you want to look for based on the above 2 items and then reevaluate your application.

I think you will find that once you are armed with more information, you will feel more confident about the status of the application's security.

share|improve this answer

I don't have any suggestion for inexpensive security auditing (I don't think you're likely to find it), but you may be able to adjust your business model. If you open source the core library, you can make money consulting on integration.

Then for the security audit, just put up a website talking about how you have impenetrable security, circulate the link and let the kids do your testing for you.

share|improve this answer
    
or even go the other route of having a GPL library with commercial licensing available –  Earlz Apr 16 '11 at 4:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.