Website security consultants

[Dm7]

Has anyone here used and can recommend a security consultant?

Unlike most sites I write, I will be developing one that will almost certainly be targeted by hackers and need an outside party to test it before it goes live.

At what point in the development process should a consultant be involved? Only at the end?

What do they check for? XSS, CSRF, SQL injection, server configuration? (The site will be written in ASP.NET MVC 3)

I imagine they don't come cheap.

 

[bin3]

You can maybe try http://www.sensepost.com/ -- heard very good things about them, though haven't used them myself.

 

[frikkie6000]

Has anyone here used and can recommend a security consultant?

Unlike most sites I write, I will be developing one that will almost certainly be targeted by hackers and need an outside party to test it before it goes live.

At what point in the development process should a consultant be involved? Only at the end?

What do they check for? XSS, CSRF, SQL injection, server configuration? (The site will be written in ASP.NET MVC 3)

I imagine they don't come cheap.

Alot I assume as injections/ login alone can take some time

I used a web vulnerability scanner a while ago that worked that well for a asp.net site framework 3.5 and definately made it much more secure have a look on google

Just make sure you dont handle credit card details etc as thats better to outsource to a third party with everything in place

 

[Dm7]

You can maybe try http://www.sensepost.com/ -- heard very good things about them, though haven't used them myself.

Thanks, I'll mail them.

Just make sure you dont handle credit card details etc as thats better to outsource to a third party with everything in place

Won't be handling any cc transactions.

 

[Beachless]

I know someone who used to work for sensepost and he was always going to conferences and training all over the world so they seem to keep pretty skilled up.

He left them a few years ago so don't know if its still the same but I would give them a try if I needed a site tested.

 

[Dm7]

I know someone who used to work for sensepost and he was always going to conferences and training all over the world so they seem to keep pretty skilled up.

He left them a few years ago so don't know if its still the same but I would give them a try if I needed a site tested.

I mailed them and am going to speak to them tomorrow.