Mfcttrf

I started a small business that provides a web application to clients, and a new customer asked for a security plan. I've never written one before.

I understand that security plans can vary in breadth and depth, depending on the service provided and the customer's needs. For my case, we are a small shop with a fairly simple CRUD web app, and the size of the contract is ~$10K, which is for a local municipality.

I can write something up to let them know that we are using an up to date web framework/SSL/database/VPN's, and that we are monitoring all services and user-generated content.

• What are some best practices that can assist me?




• How can I interpret the customer's needs in their request?

Updates:

• renamed "security profile" to "security plan" for better clarity.


• emphasized that I am looking for examples of software security plans, and guides to these plans, instead of just responding with an email.


• emphasized that I am looking for a guide or example of how to write a SaaS security plan, which fits the common pattern of a web application backed by a database.


• Updated with the Software Security Plan that I found here: http://sunguidesoftware.com/sunguidesoftware/documentlibrary/ReadingRoom/ProjectDocuments/Process%20Document%20-%2015809/SunGuideSMD-SSP-1%200%200(WorkingFinal).pdf but it's for a traffic surveillance system, which is quite different than a web application...

I am certainly not an expert on the topic, but have had to write and contribute to several security plans. Generally, what you want is a formal report, whose size is commensurate with the complexity of your operations; a plan can range from ten pages to hundreds.

The introduction should discuss your overall architecture. The meat of the report should identify all the possible risks you can think of (relating to hacking, data loss by physical disaster, etc,) your intended responses to them or mitigation strategies, and rules and procedures that ensure the responses and strategies are implemented. Basically you want to show that you’ve identified all the foreseeable risks to your clients, and have plans in place for minimizing them.

Googling “how to write a security plan” gives plenty of results.

Find out what the client’s expectations really are, and manage them. There's a world of difference between downtime measured in milliseconds, which every client wants, and downtime of a few days, which is what a $10k client will probably accept when the find out how expensive the former is.

Aside - upsell. What did they actually pay the $10k for? What else can you sell them?

Practical Suggestions

Are there any examples of a security plan from a SaaS provider -
specifically for a web app?

No - you'll have to write one.

As a starting point, Google “Owasp” and “Troy Hunt”, which will give you the top 10(?) common ways to hack a website. Write some test code/scripts to do this against your own site, then format the results: Attack / Solution / Results into a document.

This is the most basic kind of penetration test, and you should really be engaging a specialist company to do this for you (don’t though; it’ll cost a good chunk of that $10k).

...and availability of your site ...

You’re probably not hosting this app on your own servers, instead using a hosting provider. Have a look at their policy for how they guarantee uptime (or email and ask), and include that in your response to the client. ( if you are self hosting, you’re probably making a lot more work for yourself, as you lack the infrastructure for high availability/ failover)