How can clients expect small teams and individuals to be liable for a security breach when the news is filled with governments/corporations with huge ITSec budgets getting hacked? We're just web developers not security experts, are bloggers expecting to do better than financial institutions and nab an "unbreachable" product? On top of that here's no industry-wide standard to comprehensively cover all of web development so who gets to determine what's adequate and what's not?
When Can I Start Working?
If 100% security is a myth (and it is), at what level of proficiency can a responsible developer make his services available? 70% of websites have significant vulnerabilities so the people that built those obviously weren't waiting around. Learning to develop using OWASP's guide would be nice if their update was available. At least then I could explicitly state the extent of protection my sevices offer while having a respected standard to vet against. Assuming that was the case, would a disclaimer somewhere along the lines of "I am not a security company" and "I can not be held liable for losses incurred due to a breach," be enough?
Developer-Client Agreements That Include Maintenance
Some people say you should be held liable for a hack if you were contracted to maintain the site after it was finished. I think this should only be the case if the breach occured due to a failure on your part to install security patches and updates in a timely manner. To be blamed for any other 'attack vector' and I think you're being unreasonably expected to guard against every potential exploit out there (bringing us back to that 100% security myth). And as far as responding to the breach, depending upon the scope of the problem, I think it makes less sense to assume that the average developer should be competent to handle it. Seems even the security professionals are divided as to what proper protocol is. And they're specialists.
Looks like outsourcing the security for maintenance (monitoring, updates, recovery, etc.) and pre-release (testing) might be a good way to avoid liability. Would I have to explicitly state something in the contract to shift responsibility?
It seems to get confusing when you talk about outsourcing other parts of the project, like the front-end. Are sub-contractors you hire responsible for vulnerabilities on their end or will the whole project fall under you? Depending on the answer how might one coordinate contracts between the client, 3rd party security, designer, and more in a comprehensive manner that addresses both security and liability?
Information That Would Be Helpful To Me
What would be helpful to me would be to get working examples of how other freelancers deal with these security/liability issues. The specific wording of personal contracts along with any additional measures would be great. Seems legalese is just about as bullet-proof as security so should I become an LLC or take out "lawsuit insurance for developers" (just found out that was a thing)? Any knowledge or experience direct or indirect is appreciated and I'd be much obliged. Nothing provided will be taken as legal advice.