What is the best way to have security auditing done?

Question

I have an authentication system(ASP.Net library) that I want to make sure is secure. What companies/resources can I use to make sure of this? Also, what should I make sure to do before sending it off to be "broken"?

A bit more background: Basically, I'm wanting to make a little bit of money by selling this system, but I don't have a whole lot to invest in it(USD $100-$200). I'm wanting to make sure I'm selling something secure, and that buyers know it's secure. I personally have looked over the code multiple times just staring trying to find a security flaw and cannot find one. This is of course not to say there isn't one. This is where I want to pay someone to come in and look at my code and how it all works and basically tell me if it's secure or not

Answer 1

The best way to address security is education and planning. Either way you, or the product owner, are going to have the final say on if your application is secure enough or not. Here is what I suggest you focus on:

• Know what threats or attacks you would like to guard against. Here are some great resources to help with this: http://wiki.asp.net/page.aspx/47/threat-modeling/ (The important thing here is to be reasonable with your expectations)
• Educate yourself on best practices for guarding against things like cross-site scripting, sql injection, session hijacking.
• Put together a check list of what you want to look for based on the above 2 items and then reevaluate your application.

I think you will find that once you are armed with more information, you will feel more confident about the status of the application's security.

Answer 2

I don't have any suggestion for inexpensive security auditing (I don't think you're likely to find it), but you may be able to adjust your business model. If you open source the core library, you can make money consulting on integration.

Then for the security audit, just put up a website talking about how you have impenetrable security, circulate the link and let the kids do your testing for you.