For months now, when building websites
for clients, I've come across virtually trillions of "Site Security Scanners" supposedly
endorsed/approved by various shared web hosts who claim to run XSS, SQL injections, spam
measures, and other checks, all for around $300 upwards if you want the plans that do
more than one scan a year.
I'm not talking about
PCI compliance scans like those offered by Comodo, McAfee, Symantec and the like, which
normally cost thousands per year, but rather these vendors seem to be playing off the
fear of less technical business owners by offering an affordable alternative to the PCI
fims.
Although I could mention a few companies,
I know of too many to list, so my main question is: Are these "affordable" scans a good
alternative to a PCI scanner if you don't do eCommerce. What about if you're on a
shared/managed plan -- shouldn't the host handle
this?
As for sites with eCommerce,
since some merchants processors mandate their own PCI vendors, or even cover the cost of
PCI scans, is it necessary to have an additional scan
happening?
Thank you very much to everyone for
any insights as this has been on my mind for ages.
Answer
Sturgeon's Law of IT ("90% of everything is snakeoil") applies to this as much
as it does to any other aspect of IT. We all know that PCI is just a flaming
hoop/bag-of-dog-poo you need to jump through to process credit cards (a "cost of doing
business", like paying off your local neighbourhood mobster for "protection"), and not
an actual security audit; these automated scans are like walking up to someone random on
the street and offering them $100 to not burn down your
store.
The only time I might consider one of
these places is as an insurance policy against really incompetent developers (that I had
no ability to just get rid of). Make it a mandatory part of the acceptance testing that
if their code failed one of these scans, they get paid nothing (and, preferably, they
get beaten with a stick and set on fire). I can't imagine any sort of automated scan
finding issues with the code of a competent web developer in 2011 -- it's not as though
any of the issues aren't well-known, and hiring competent people is the most important
aspect of running any business.
That being said,
the best way to make money is to find suckers, and I'll bet these companies are making
plenty of money. Just make sure you're not one of the suckers. To really gauge the
effectiveness of any of these companies, just ask them what sort of guarantees they make
about their product -- if they're not willing to provide some sort of written guarantee
that they've found all the security problems (and that they're willing to be liable if
you get hacked in the future), then not only are they selling snake-oil, they
know they're selling snake-oil.
Comments
Post a Comment