tags:

views:

38

answers:

1
Q: 

Review Security for a product developed on ASP.NET MVC..

We are planning to buy a product that's developed on ASP.NET MVC, JQuery, SQL 2005. .basically latest MS stack. This product is going to store some of very highly sensitive data.

So, we need to evaluate that product in terms of security.

But I'm confused as in How can I certify that this product is secure and we can buy it.

I don't have the luxury to peep into source code unless I buy that product.

What are the options I have?

A: 

Not programming related, the only thing you can do is look at any available documentation. What type of software is it? Can you call the company and ask for literature?

JonH  2009-10-27 17:30:57
Imagine it as something like probably a online banking? I mean as sensitive as it can be..
Broken Link  2009-10-27 17:39:34
You will need to get some sort of eval or free copy to evaluate, you really do not have any other option. If the company does not want to let you use / eval it then that is a risk you take.You can also try to consult with past clients. See how happy they are with the SAME system...
JonH  2009-10-27 17:52:45

related questions

Encryption in C# Web-Services
How Do You Secure database.yml?
ASP.NET LocationProvider
What do you (or your company) use for wiping a machine?
Can a proxy server cache SSL GETs? If not, would response body encryption suffice?
Java: What is the best way to SFTP a file from a server
How do I call a Flex SWF from a remote domain using Flash (AS3) ?
Best way to store a database password in a startup script / config file?
Using VM to get around VPN restrictions
Best references for secure coding practices in ASP.NET and classic ASP.
Secure Memory Allocator in C++
Resolving Session Fixation in JBoss
Best Practices for securing a REST API / web service
Defensive programming
Personal Linux web server
Block user access to internals of a site using HTTP_REFERER
Is there an Unobtrusive Captcha for web forms?
My website got hacked... What should I do?
What all do I need to escape when sending a (My)SQL query?
How do you disable browser Autocomplete on web form field / input tag?
Best .NET obfuscation tools/strategy
Are there best practices for testing security in an Agile development shop?
What is the best way to avoid SQL injection attacks?
Found a critical bug, but the company doesn't care
PHP Session Security