14 ms·

What does it cost to hire somebody reputable to perform an audit like this? Its something I want to look into for one of my own projects, but I have no frame of

What does it cost to hire somebody reputable to perform an audit like this? Its something I want to look into for one of my own projects, but I have no frame of reference for what is a reasonable price for a simple full stack app (way simpler than bitwarden for sure)

Narkov 6y ago
Unfortunately, it varies wildly. Some firms can perform fully automated remote scans for a few hundred $$$ and it can move all the way up to 100+ page reports with manual pen testing for literally hundreds of thousands of dollars. What you want or need will fit somewhere in between.
nix23 6y ago
Just ask them. Cure53 is one of the most reputable one's, and remember always make white-box testing, you want to test your system, NOT the security researcher.
dabeeeenster 6y ago
We (https://www.bullet-train.io/ https://www.bullet-train.io/) recently had a third party perform a pretty in depth security audit - cost was low to mid 4 figure Euro. Result was a ~20 page report - I felt it struck the right balance of cost / effectiveness.
morrbo 6y ago
Pentester for 10 odd years: usually for an external test you would scope it at X days depending on the number of IPs etc. And it should note that an external test really doesn't find much. External is usually £750/day for 1-2 days testing and one reporting. Internal testing (ie. Auditing a domain and all computers attached) is about the same price, maybe a bit more, and takes a bit longer usually. A build review is hardening the server itself, takes about a day and a day reporting. App testing is totally dependent on the app itself (this is where people have a crack at an actual installed web application usually using user accounts etc. And runs a bit more - £800+ per day usually. Specialist stuff (hardware testing, code review (what I used to do), social engineering, hardcore app testing (stuff like auditing bespoke network devices, high frequency trading apps, etc. Etc.)) is typically 1-1.2k a day. You can get it cheaper but a lot of it - for better or for worse - really comes down to the skill of the individual consultant. You can pretty much halve these prices, but then you'd end up getting stuff outsourced to India and it wouldn't be any good. Depends if you care about the security of your product or just want a box ticked for some arbitrary compliance and want it done as cheap as possible. I haven't been a tester/consultant for a few years now, but the prices hold up. That being said one development which has happened since I've left the industry is the advent of crowd sourced pentesting. I know a lot of friends who moonlight with these things and are very good at their jobs, and the rates are lower. The name crowd strike comes to mind, but I'm not 100% sure if that was the company or not. I know a lot of good UK based companies (if it's a web app/remote then the physical testers location doesn't matter) if you needed.
- starfallg 6y ago
  Your comment really surprised me as I didn't expect that this was just a pen-test, but after visiting the link, indeed it was! I think it's a bit sneaky as for a product like this, people expect this to be a code and crypto audit. The "network" part should be emphasised and in the title of the page, instead of just the PDF.
  - user5994461 6y ago
    In this business the title "External Penetration Test and Vulnerability Assessment" means the auditing company has run qualys/nessus* against bitwarden.com. * expensive commercial vulnerability scanning tools.
    - starfallg 6y ago
      Yes, but the title of the page/blog post is "Security Audit Complete".
      - _jal 6y ago
        A page title fails to correct your misconception about a multiyear project and it is their fault? This is one reason why people don't release this stuff in public.
  - deleted 6y ago
    [deleted]
- splynch 6y ago
  Those prices might stand up for contractors -- but are a bit low to bring in a commercial outfit, at least for any of the larger reputable security consulting businesses. Would suggest starting prices would be closer to £1000 a day. And rates are significantly higher in the US. Accountability and consistency is a real concern in crowdsourcing. There is a reason we dont spend too much time designing an idea and then crowdsourcing all development. Why would security be different?
user5994461 6y ago
The attached PDF is an automatically generated report. You can get something like that for £5-10k if you go through one of the typical audit firms (KPMG, Deloitte and co). In addition you can look into some ISO certifications or industry specific regulations. It's basically a checklist of a thousand questions: do you use TLS? are your applications protected by authentication? can custom folks access personal data of customers? are there audit logs of support accessing customer information?
- Aeolun 6y ago
  If you want an automatically generated report you can just run ZAP, Burp or Checkmarx against your system yourself :/
jiveturkey 6y ago
the cost varies widely. $8k - $12k for a "platform" that hires 100% outsourced pentesters of highly variable skill and quality, and takes no liability themselves, and whose pentesters are located in developing countries and good luck getting damages out of them, ever, regardless of their platform "reputation" pretend points. also communication tends to be difficult as the norm is ESL. $25k for a US-based boutique firm with in-house pentesters of vetted high quality, who accept liability and against whom you can actually expect to enforce an NDA and/or extract other damages. source code and design audit starts at about this price. then, you can run your own program on top of the bounty platforms, however scope and focused work is not going to happen (a lot of the work is boring), and it will cost you a lot of your own time. the money you save DIY is not worth your own time investment. if you actually want a good pentest, go with a boutique, quality firm. if you want something to give to an auditor or to meet a VSA, go with cheap.

Narkov 6y ago

Unfortunately, it varies wildly. Some firms can perform fully automated remote scans for a few hundred $$$ and it can move all the way up to 100+ page reports with manual pen testing for literally hundreds of thousands of dollars. What you want or need will fit somewhere in between.

nix23 6y ago

Just ask them. Cure53 is one of the most reputable one's, and remember always make white-box testing, you want to test your system, NOT the security researcher.

dabeeeenster 6y ago

We (https://www.bullet-train.io/ https://www.bullet-train.io/) recently had a third party perform a pretty in depth security audit - cost was low to mid 4 figure Euro. Result was a ~20 page report - I felt it struck the right balance of cost / effectiveness.

morrbo 6y ago

Pentester for 10 odd years: usually for an external test you would scope it at X days depending on the number of IPs etc. And it should note that an external test really doesn't find much. External is usually £750/day for 1-2 days testing and one reporting. Internal testing (ie. Auditing a domain and all computers attached) is about the same price, maybe a bit more, and takes a bit longer usually. A build review is hardening the server itself, takes about a day and a day reporting. App testing is totally dependent on the app itself (this is where people have a crack at an actual installed web application usually using user accounts etc. And runs a bit more - £800+ per day usually. Specialist stuff (hardware testing, code review (what I used to do), social engineering, hardcore app testing (stuff like auditing bespoke network devices, high frequency trading apps, etc. Etc.)) is typically 1-1.2k a day. You can get it cheaper but a lot of it - for better or for worse - really comes down to the skill of the individual consultant. You can pretty much halve these prices, but then you'd end up getting stuff outsourced to India and it wouldn't be any good. Depends if you care about the security of your product or just want a box ticked for some arbitrary compliance and want it done as cheap as possible. I haven't been a tester/consultant for a few years now, but the prices hold up. That being said one development which has happened since I've left the industry is the advent of crowd sourced pentesting. I know a lot of friends who moonlight with these things and are very good at their jobs, and the rates are lower. The name crowd strike comes to mind, but I'm not 100% sure if that was the company or not. I know a lot of good UK based companies (if it's a web app/remote then the physical testers location doesn't matter) if you needed.

starfallg 6y ago
Your comment really surprised me as I didn't expect that this was just a pen-test, but after visiting the link, indeed it was! I think it's a bit sneaky as for a product like this, people expect this to be a code and crypto audit. The "network" part should be emphasised and in the title of the page, instead of just the PDF.
- user5994461 6y ago
  In this business the title "External Penetration Test and Vulnerability Assessment" means the auditing company has run qualys/nessus* against bitwarden.com. * expensive commercial vulnerability scanning tools.
  - starfallg 6y ago
    Yes, but the title of the page/blog post is "Security Audit Complete".
    - _jal 6y ago
      A page title fails to correct your misconception about a multiyear project and it is their fault? This is one reason why people don't release this stuff in public.
- deleted 6y ago
  [deleted]
splynch 6y ago
Those prices might stand up for contractors -- but are a bit low to bring in a commercial outfit, at least for any of the larger reputable security consulting businesses. Would suggest starting prices would be closer to £1000 a day. And rates are significantly higher in the US. Accountability and consistency is a real concern in crowdsourcing. There is a reason we dont spend too much time designing an idea and then crowdsourcing all development. Why would security be different?

user5994461 6y ago

The attached PDF is an automatically generated report. You can get something like that for £5-10k if you go through one of the typical audit firms (KPMG, Deloitte and co). In addition you can look into some ISO certifications or industry specific regulations. It's basically a checklist of a thousand questions: do you use TLS? are your applications protected by authentication? can custom folks access personal data of customers? are there audit logs of support accessing customer information?

Aeolun 6y ago
If you want an automatically generated report you can just run ZAP, Burp or Checkmarx against your system yourself :/

jiveturkey 6y ago

the cost varies widely. $8k - $12k for a "platform" that hires 100% outsourced pentesters of highly variable skill and quality, and takes no liability themselves, and whose pentesters are located in developing countries and good luck getting damages out of them, ever, regardless of their platform "reputation" pretend points. also communication tends to be difficult as the norm is ESL. $25k for a US-based boutique firm with in-house pentesters of vetted high quality, who accept liability and against whom you can actually expect to enforce an NDA and/or extract other damages. source code and design audit starts at about this price. then, you can run your own program on top of the bounty platforms, however scope and focused work is not going to happen (a lot of the work is boring), and it will cost you a lot of your own time. the money you save DIY is not worth your own time investment. if you actually want a good pentest, go with a boutique, quality firm. if you want something to give to an auditor or to meet a VSA, go with cheap.