The title pretty much tells you my problem, there is no other error message. It is a lengthy question, that's the only thing I can think of.
*I just posted the original since it doesn't seem to matter. This is the title:
How do freelance web developers approach web security and liability?
The question is:
Sooo many questions, where to begin? With governments and huge corporations spending god knows what on cyber security just to get hacked I think it's safe to say that there is no such thing as a 100% secure system. So that begs the question as to what level of proficiency is adequate before you can release your product into the wild? A question that is made even more difficult to answer due to the fact that there is no industry-wide standard. You have PCI-DSS when dealing with credit cards, regulations you have to follow when building for the health sector, and OWASP would be great if they weren't waiting to replace their developer guide from 2005. As it stands there just isn't anything that neatly covers the current scope of web development.
I'm sure you get actors across the spectrum who deal with this in different ways. I'm sure some throw caution to the wind and release every bug-filled app the minute it's done while others, like me, disect every potential liability before even attempting to step into the industry. Really someone even as neurotic as myself wouldn't have given this a second thought had I not read that people would expect me to be liable in the event of a breach. I mean all I want to do is make a website for my client's collection of cat memes (I said my client's, not mine.... okay maybe mine) and now you're telling me I have to buy something called cyber insurance because I might get sued?
I read somewhere something like 70% of websites have serious vulnerabilities, which to me makes sense. Realistically how can you expect every two-bit blogger to have the same level of security as a multi-million dollar corporation? That sort of thing has to come at a premium. The crazy thing is actually hearing people call for the heads of small or even single-man developer teams. Expecting perfect security when even the big boys are getting whacked, I mean hacked. I'm assuming the road to becoming a security guru is a long one and it seems unreasonable to expect web developers to be there before they're allowed to provide services.
Okay here's my question. Like I said I'm sure people approach this in many different ways and what I want to get is a sense of common industry practices and hopefully some advice to go along with it. I'm sure a lot of this will come down to the wording in the contract so here we go: Will something like "We are not a security company and cannot be held liable for any losses incurred in the event of a breach. We do our best to yada yada," have any impact? What if this isn't a one-man operation and you're outsourcing the front-end, or vice-versa. Does 'who's responsible' rely on the contract also or is it more important where the breach occured (front or back)? What if you're outsourcing the actual security (not sure how you would do that, maybe testing)? Who's liable? Is insurance a serious consideration in the event of a lawsuit?
I need to know what happens if you have an agreement to maintain the site after it's launched - this is actually the topic that got me interested in the first place. When I first searched the issue of liability on stack the consensus was if you were contracted to maintain the site after the build then yes you would be held liable. Now at first glance that might seem logical but I think you have to look at where breach occured. It seems reasonable to expect software updates and security patches to be included under maintenance and if an attack was possible because you failed to do so in a timely matter than yes you should be held liable. A breach under any other circumstance I would say no because again as a lone developer or small team you can't be expected to code for every possible exploit, I mean just think about all the Wordpress developers and the fact that they might be subject to a lawsuit. How can you expect developers to contain, remove, and repair after an attack correctly when they're not even equipped to do so? These aren't web security experts and they're going to be navigating uncharted waters. Given the nature of the situation they also won't have the time to learn on the go.
What I'm looking for is ways to mitigate all of these potentials both in the contract and outside (because apparently even legal wording may fail to protect you). How do some of you write security before and after a breach into your agreement, including disclaimers and how to handle the issue? If using third-party security what's the legalese in regards to responsibility for payment? Do things like scope of maintenance and complexities brought on by subcontracting the project require consideration? As you can see this is a wide-ranging topic (probably beyond what I've included) and I'd like to get as complete of opinions as possible. These of course will not be taken as legal advice so feel free to chip in and bring anyone who might have valuable insight or authority.