2

Our customer wants to run IBM Rational AppScan on our website. What legal agreement should we have in place to protect each party and what concerns should I have before letting them run it? What does AppScan check for and is there a risk it can delete or mess up our database? They want to have an agreement in place before they run it, so we can't sue them. And I'm scared they're going to crash our system or truncate our database.

In response to some of the answers, the website is not publicly available. It requires a username and password. Also, the scan is required, the customer is a Fortune 100 company, and we want their business. I think the best option is to have them run it on a test bed.

2
  • Is this a condition for which they will not to business with you until the scan is performed?
    – DanBig
    Sep 24, 2010 at 19:46
  • 1
    It is better that they run it and tell you what fails than an unknown person runs it and doesn't tell you what fails. You need to not be scared and make sure that scans like this highlight your weaknesses so they can be secured. Most people scanning your site for vulnerabilities are not doing so in the interest of ensuring it is secure, in fact they are doing so to find out that it is not secure. As far as the legal side goes - I am not a lawyer, so no answer from me. Sep 24, 2010 at 20:48

6 Answers 6

4

If it is a condition of doing business with them, sure (and you should be doing this yourself anyway ... ) if not talk to the sales/account rep who handles them and see if they can read on how much saying no would hurt the relationship.

As far as legal agreements before hand I would say at a minimum you should have the following:

  • NDA specifying that they cannot disclose any vulnerabilities found outside of people inside of their organization that have a need to know about them.
  • Agreement to do the run either against a QA/Staging instance, or at off peak hours
  • Liability - they are liable for any lost revenue due to the program breaking things
  • The run will be co-ordinated with your NOC/Systems/Network/whoever else so that no one is suprised and everyone is ready just in case.
2

You have a dev/qa instance of your site, right? Let them hit that!


EDIT:

If you're running a multi-tenant service, allowing a customer to run security scanning software that actively attempts to exploit security vulnerabilities is a really bad idea. It's especially bad if the customer wants you to contractually agree to hold them harmless for damage done to you and potentially to data belonging to other customers.

Not acceptable. I would be displeased if I were another customer.

The features of IBM AppScan aren't relevant, as they may use product X next year which is completely different. Unless this is a throw-away project, the need to do this is going to come up again -- even if your contact at the customer claims that it's a one-time thing.

On the other hand, a Fortune 100 customer needs assurance that its data is protected while in the hands of a 3rd party service provider. They won't budge on that, so you need a compromise.

Some ideas:

  • Offer to do the scan yourself on a regular basis (quarterly, biannually, annually, per major release, etc). Offer them the unadulterated output of the report within 10 business days of the scan, subject to an SLA condition. (ie, you will pay a financial penalty if the report is late)
  • Allow them to run the scan, but only after working with your team on the dev side. This needs to be a contract term.
  • Isolate this customer from others.
4
  • NO! plain and simple they want to test production because they will be sending data to production not dev/qa.
    – Liam
    Sep 25, 2010 at 2:49
  • But doesn't Appscan test for things like SQL injection which is code. I don't think they're looking at stuff like ports. So the code is identical from live to qa. Sep 25, 2010 at 4:03
  • I'm going to edit my response to address your comment. Sep 25, 2010 at 22:57
  • @Liam Testing in production is almost always a bad idea. Any Tester worth his salt will tell you that it should be avoided whenever possible. AppScan can crash the target application as well as mess up its DB while sending test exploits.
    – Steven
    Sep 30, 2011 at 13:01
1

Is the web-site open to the internet?

If so, i hardly see how you can prevent them, or anyone else, from probing the web-site.

In fact, if you wrote your site badly enough even Google's page crawler can delete everything.


But to answer your specific question "Should we let them..."

Yes. You want to learn where the flaws are so you can grow as a programmer.

Legal agreement? No. If you lose everything, then restore from a backup. If you didn't want everything deleted then you shouldn't have had it on the internet.

1

Ask them to kindly run it during an "off peak" time for your site. Appscan can put a massive load on the web and app servers. The extent of the load depends on your specific enviroment it might not be much of an impact or it might be extreamly high, note a low or high load is not a good or bad thing. If your have serious configuration problems there is a very slight chance of crashing a server to the point of needing reboot. The short of the matter is that it is on the internet and there is nothing you can do to stop someone from kicking the crap out of your web servers and running away with your data if your screwed up design, code, or configuration of the site.

1

Maybe a better approach would be to run this sort of stuff yourself so you can proactively test and improve your application security and availability, and share the results with interested customers?

1
  • I looked into it and the AppScan program is really expensive. They actually have a lot more money than me so I think I'll use them to help me get better. Sep 26, 2010 at 4:48
1

My feeling is that because anyone can run a scan against an Internet facing web server (or any kind of server if it comes to that) you should having nothing to fear by allowing them to do so. The fact that you're asking the question at all suggests that you are distinctly less than confident in the security of your system.

I recommend you run a series of scans yourself first, which is something you really should do on a regular basis anyway. Find out what breaks, fix it fast and let your client go for it. If their scan breaks your server it's only a matter of time before someone else does it anyway, except they will do it on their terms, not yours.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .