Security Questions to Ask an ASP

Ask potential application service providers the following questions, supplied by Greg Gianforte, CEO of ASP RightNow Technologies. There isn’t a single set of correct answers; the point is that a few simple yes and no questions won’t generally get you enough information to know whether the ASP offers an appropriate level of security for your particular application.

Physical Security

• Describe the physical security and disaster recovery and prevention features of the ASP’s data center.
• Who (including data center staff, other employees and vendors) has physical access to the host servers?

Network Security

• Are industry-standard firewalls deployed? Where are they deployed? How does the ASP keep the software for the firewalls current? Is administrative access to firewalls and other perimeter devices allowed only through secure methods or direct serial port access?
• What protocols and ports are allowed to traverse the network and firewall?
• Does the ASP use intrusion detection systems (IDSs)? How long are IDS logs kept?
• Are formal incident-response procedures in place? Are they tested regularly?
• Does the ASP engage third-party security services providers to perform ongoing vulnerability assessments?

Systems Security

• Are ongoing vulnerability assessments performed against the systems?
• Are file permissions set on a need-to-access basis only?
• How are operating systems kept up-to-date? How does the ASP keep abreast of software vulnerabilities? What is the procedure for installing software updates?
• Are audit logs implemented on all systems that store or process critical information? Are root commands logged?
• What change management procedures are in place?

Staff Security

• What are the credentials of the systems administration staff?
• Has the systems administration staff undergone complete background and criminal checks?
• Are hosting staff onsite or on-call 24/7?

Security Policy

• Describe the user account and password policy.
• Are screen-blanking mechanisms deployed on all employee workstations? Do sessions automatically time out after an idle period?
• Are user accounts for contract personnel created with expiration dates? How are user accounts closed after termination?