Solved

website app software security, opinions requested

Posted on 2011-02-15
4
448 Views
Last Modified: 2013-11-29
hello

we are evaluating a software package, and need to decide if we want to run it on our IIS7 server.  the application is a frontend for our backend database suite.

the software vendor has given us a link to their sandbox and asked us to check it out.  for me, at the helpdesk, i only really care about security and not so much about functionality.  so i'm hoping you guys could check it out (it's public) and offer your suggestions that pertain to vulnerabilities, etc.

the data in the sandbox is all fake, just place holders - and anyone can create any fake info (name, address, etc - create an account for yourselves).  the idea is this front end is customer facing, and random people will be using it to search our database and create accounts for themselves to upload their own resumes, and contain their own personal information which plugs to the backend (which is SQL)

the sandbox is the URL below - i'm intentionally not typing it directly as to be fair to the software vendor - if there are huge problems we'll get them fixed, but it wouldn't be fair for future google searchers to stumble upon this (assuming any problems exist and eventually do get fixed)

if you post links pointing to certain pages that may present security issues, it would be appreciated to break them up a little just to be fair

www dot jobs on a stick dot com


0
Comment
Question by:B H
4 Comments
 
LVL 30

Accepted Solution

by:
Brad Howe earned 500 total points
ID: 35826895
Hi,

Requesting a penatration test requires strict approval planning and guidance. Asking random users in a public forum could get them sued.

What you have provide is partial disclosure and no approval from either the company owner, hosting provider etc.

If you are looking for a security assessment to be completed on your web application, it should be done properly by hiring a certified security professional.

http://jeffersonwells.de/de_en/CenterofExpertise/InformationSecurity.htm
http://www.ivizsecurity.com/application-penetration.html
http://www.redspin.com/

Cheers,
Hades666
0
 
LVL 24

Author Closing Comment

by:B H
ID: 35934046
you're absolutely right, thanks for the links
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Hide http port number 5 41
ticket bloat 3 22
SharePoint Explorer Folder Access 4 35
Review of a VPN cert policy 4 26
Pop culture is prime bait for hackers seeking to infect user’s computers and mobile devices with malicious malware. Hackers know exactly what the latest trends are online and know how to use them to their advantage.
How do we balance the user experience (UX) with reasonable security measures? It can be done, if you keep these fundamentals in mind.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

815 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now