-2

I started a small business that provides a web application to clients, and a new customer asked for a security plan. I've never written one before.

I understand that security plans can vary in breadth and depth, depending on the service provided and the customer's needs. For my case, we are a small shop with a fairly simple CRUD web app, and the size of the contract is ~$10K, which is for a local municipality.

I can write something up to let them know that we are using an up to date web framework/SSL/database/VPN's, and that we are monitoring all services and user-generated content.

  • What are some best practices that can assist me?

  • How can I interpret the customer's needs in their request?

Updates:

|improve this question
  • Is there any reason why this received a close vote? – niceEarthling Jun 29 at 18:00
  • 2
    This is usually called a security plan not a security profile. If you google “How to write a security plan,” you will see many excellent resources. – Ernest Friedman-Hill Jun 29 at 18:11
  • 2
    Far too technical for The Workplace so a comment rather than an answer: running on AWS does not make your system more secure than running it anywhere else (it doesn't make it less secure either). Don't include that in a plan unless you can show that you understand the shared security model. – Philip Kendall Jun 29 at 18:19
  • 1
    Meta discussion to reopen at this link - workplace.meta.stackexchange.com/questions/6208/… – Anthony Jul 2 at 3:39
4

I am certainly not an expert on the topic, but have had to write and contribute to several security plans. Generally, what you want is a formal report, whose size is commensurate with the complexity of your operations; a plan can range from ten pages to hundreds.

The introduction should discuss your overall architecture. The meat of the report should identify all the possible risks you can think of (relating to hacking, data loss by physical disaster, etc,) your intended responses to them or mitigation strategies, and rules and procedures that ensure the responses and strategies are implemented. Basically you want to show that you’ve identified all the foreseeable risks to your clients, and have plans in place for minimizing them.

Googling “how to write a security plan” gives plenty of results.

|improve this answer
  • Thank you for the answer! But now I'm wondering where I can find examples of security plans for a web application? (I updated my question above) The documents that I found were mostly focused on desktop applications and other software systems, which is helpful, but doesn't have the same security concerns as a web app... – niceEarthling Jun 29 at 21:33
  • Yes, that is true. I am writing it myself, but I am concerned about the legalese and making sure that I haven't missed any details. Perhaps I am being lazy, but we are a 3 person shop, so I would like to avoid writing a ~10 page legal document if at all possible. Plus, I suspect there are lots of security plans for web apps out there, although I can understand why they aren't readily available. – niceEarthling Jun 30 at 1:16
  • Of course, I'm trying not to overthink it, so my current plan is to whip together a 4-5 page doc and focus on the client's real needs ;) – niceEarthling Jun 30 at 1:23
  • 1
    I wouldn’t worry about legalese; the details would depend on your client and jurisdiction anyway. You already said it’s not a high-consequence system; just address your approaches for preventing various kinds of penetration and for backup and recovery and you should be good. – Ernest Friedman-Hill Jun 30 at 1:25
  • 1
    Plus, I suspect there are lots of security plans for web apps out there, although I can understand why they aren't readily available Because this is how consultancy companies make money, at between $1k and $50k+. Some have ongoing contracts to provide realtime monitoring, others to perform annual security reviews. They're not going to leave these lying around for their competitors to use, or give you a head start. – Justin Jun 30 at 10:43
1

Find out what the client’s expectations really are, and manage them. There's a world of difference between downtime measured in milliseconds, which every client wants, and downtime of a few days, which is what a $10k client will probably accept when the find out how expensive the former is.

Aside - upsell. What did they actually pay the $10k for? What else can you sell them?

Practical Suggestions

Are there any examples of a security plan from a SaaS provider - specifically for a web app?

No - you'll have to write one.

As a starting point, Google “Owasp” and “Troy Hunt”, which will give you the top 10(?) common ways to hack a website. Write some test code/scripts to do this against your own site, then format the results: Attack / Solution / Results into a document.

This is the most basic kind of penetration test, and you should really be engaging a specialist company to do this for you (don’t though; it’ll cost a good chunk of that $10k).

...and availability of your site ...

You’re probably not hosting this app on your own servers, instead using a hosting provider. Have a look at their policy for how they guarantee uptime (or email and ask), and include that in your response to the client. ( if you are self hosting, you’re probably making a lot more work for yourself, as you lack the infrastructure for high availability/ failover)

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.