Many web based businesses are ideas in the heads of non-technical entreprenuers that are translated into action by web application developers. Selecting the right web developer is key to a successful web based business.
Make sure you secure your value when you select a service provider to develop your great idea, million dollar mousetrap or next big thing by asking these questions:
1. Does the developer have an active portfolio of sites that handle content, information and processes similar to your planned site?
2. Will they let you select references from their portfolio (rather than tying you to those they hand pick)? Ask the references how site security was considered during the course of the project.
3. Does the service provider consider secure coding as important to your project’s success as the ascetics and functionality of the site?
4. Does the provider use templates as a base for their work or do they develop everything “from scratch” based on a custom model?
· If they use templates ….
o Are the templates developed in house, acquired from a trusted source, or acquired from the public domain?
o Regardless of the source, how do they validate that no known vulnerabilities are in the template code?
· If they write all of the code themselves …
o What is their development process?
o Do they develop all of the code in house with company employees?
5. Do they test the code before its release for performance and security vulnerabilities?
6. How do they validate they are delivering a secured site?
7. Will they include an independent 3rd party vulnerability assessment in their service that must be passed before you'll accept delivery?
8. Do they consider information security in their contract? Do they offer a guarantee that code is provided with no known vulnerabilities?
9. Does their service (and price) include maintenance on the code they provide? Does the maintenance include both in house developed code and template based code? Are security considerations included in their maintenance processes?
10. How do they monitor new vulnerabilities in the code they produce? Will they guarantee or warranty their code?
11. Does the service provider vault the code so you have a secure code set to restore to in the case of a breach?