For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL injections, spam measures, and other checks, all for around $300 upwards if you want the plans that do more than one scan a year.
I'm not talking about PCI compliance scans like those offered by Comodo, McAfee, Symantec and the like, which normally cost thousands per year, but rather these vendors seem to be playing off the fear of less technical business owners by offering an affordable alternative to the PCI fims.
Although I could mention a few companies, I know of too many to list, so my main question is: Are these "affordable" scans a good alternative to a PCI scanner if you don't do eCommerce. What about if you're on a shared/managed plan -- shouldn't the host handle this?
As for sites with eCommerce, since some merchants processors mandate their own PCI vendors, or even cover the cost of PCI scans, is it necessary to have an additional scan happening?
Thank you very much to everyone for any insights as this has been on my mind for ages.
Answer
Sturgeon's Law of IT ("90% of everything is snakeoil") applies to this as much as it does to any other aspect of IT. We all know that PCI is just a flaming hoop/bag-of-dog-poo you need to jump through to process credit cards (a "cost of doing business", like paying off your local neighbourhood mobster for "protection"), and not an actual security audit; these automated scans are like walking up to someone random on the street and offering them $100 to not burn down your store.
The only time I might consider one of these places is as an insurance policy against really incompetent developers (that I had no ability to just get rid of). Make it a mandatory part of the acceptance testing that if their code failed one of these scans, they get paid nothing (and, preferably, they get beaten with a stick and set on fire). I can't imagine any sort of automated scan finding issues with the code of a competent web developer in 2011 -- it's not as though any of the issues aren't well-known, and hiring competent people is the most important aspect of running any business.
That being said, the best way to make money is to find suckers, and I'll bet these companies are making plenty of money. Just make sure you're not one of the suckers. To really gauge the effectiveness of any of these companies, just ask them what sort of guarantees they make about their product -- if they're not willing to provide some sort of written guarantee that they've found all the security problems (and that they're willing to be liable if you get hacked in the future), then not only are they selling snake-oil, they know they're selling snake-oil.
Comments
Post a Comment