How do freelance web developers approach security and liability?

Question

Liability

How can clients expect small teams and individuals to be liable for a security breach when the news is filled with governments/corporations with huge ITSec budgets getting hacked? We're just web developers not security experts, are bloggers expecting to do better than financial institutions and nab an "unbreachable" product? On top of that here's no industry-wide standard to comprehensively cover all of web development so who gets to determine what's adequate and what's not?

---

When Can I Start Working?

If 100% security is a myth (and it is), at what level of proficiency can a responsible developer make his services available? 70% of websites have significant vulnerabilities so the people that built those obviously weren't waiting around. Learning to develop using OWASP's guide would be nice if their update was available. At least then I could explicitly state the extent of protection my sevices offer while having a respected standard to vet against. Assuming that was the case, would a disclaimer somewhere along the lines of "I am not a security company" and "I can not be held liable for losses incurred due to a breach," be enough?

---

Developer-Client Agreements That Include Maintenance

Some people say you should be held liable for a hack if you were contracted to maintain the site after it was finished. I think this should only be the case if the breach occured due to a failure on your part to install security patches and updates in a timely manner. To be blamed for any other 'attack vector' and I think you're being unreasonably expected to guard against every potential exploit out there (bringing us back to that 100% security myth). And as far as responding to the breach, depending upon the scope of the problem, I think it makes less sense to assume that the average developer should be competent to handle it. Seems even the security professionals are divided as to what proper protocol is. And they're specialists.

---

3rd Parties

Looks like outsourcing the security for maintenance (monitoring, updates, recovery, etc.) and pre-release (testing) might be a good way to avoid liability. Would I have to explicitly state something in the contract to shift responsibility?

It seems to get confusing when you talk about outsourcing other parts of the project, like the front-end. Are sub-contractors you hire responsible for vulnerabilities on their end or will the whole project fall under you? Depending on the answer how might one coordinate contracts between the client, 3rd party security, designer, and more in a comprehensive manner that addresses both security and liability?

---

Information That Would Be Helpful To Me

What would be helpful to me would be to get working examples of how other freelancers deal with these security/liability issues. The specific wording of personal contracts along with any additional measures would be great. Seems legalese is just about as bullet-proof as security so should I become an LLC or take out "lawsuit insurance for developers" (just found out that was a thing)? Any knowledge or experience direct or indirect is appreciated and I'd be much obliged. Nothing provided will be taken as legal advice.

Answer 1

I'm a freelance web developer and security researcher, so my experience may be a little biased.

In general, web development is a pretty insecure mess. More experienced developers are generally seen as more security-focused programmers; you first learn to program, then you learn to program well, then you learn to program securely.

In general, if your client is focused on security, recommend that they have an independent security audit as part of the signing-off process. This will be a team or individual who will do analysis of code, general penetration testing, and so on, and you'll be given a report of things to fix before final sign off. This should be worked out beforehand with your client, and you should be sure to include an indemnity clause in your contract for what you have created.

I'm not a lawyer, but this is from my contract:

Legal Stuff

I can’t guarantee that my work will be error-free and so can’t be liable to you or any third-party for damages, including lost profits, lost savings or other incidental, consequential or special damages, even if you’ve advised myself of them. Finally, if any provision of this contract shall be unlawful, void, or for any reason unenforceable, then that provision shall be deemed severable from this contract and shall not affect the validity and enforceability of any remaining provisions.

_{Original Source - Contract Killer 3}

As a web developer, your responsibility is to plug any obvious holes. This can be found on OWASP (the Open Web Application Security Project), in their top 10 vulnerabilities, but for brevity, you need to mitigate the following things:

• SQL Injection (Or any injection!)
• Broken Auth/Session Management (Impersonating other users)
• Cross-Site Scripting (XSS)
• Security Configuration
• Exposing Sensitive Data
• Cross-site Request Forgery (CSRF/XSRF)
• Reflected Redirects (blindly doing redirect($_GET['redirect']), for example)

In addition, regardless of where you are in the world and what data privacy laws are, make sure you adhere to the most strict privacy laws in the world (most EU states) if your application collects sensitive data. Separation of Concerns in all aspects of your app should be adhered to; just following most privacy laws leads to reduced data leaks.

Answer 2

As you stated, individual freelancers or small teams can't provide the same security levels reached by big corporations, but we can do all is that is possible to reach a reasonable level of security, considering also the fact that (usually) big corporations has big attacks and tons of data to loose while a small business has lower number of attacks (this is not a law but in general is like that).

About security in office and workplaces, in EU we have a complex and specific law that regulates how you should keep and protect data (physical and digital) and keep safer as possible the computer with various protocols. If you stay within this law you are legally ok no one can say anything. Personally I paid for a consultancy to a professional that prepared all the papers and instructed me on the protocols to keep (since also I have no time to do that myself).

About web site security, the most secure way (but let's say the less unsecure) to develop a web site is to adopt a reasonably stable platform and components and keep them updated as soon as they has upgrades available, and use also a quality hosting provider. That is what I am able to do as a single or small team driven project. And since now I never had big problems so far.

About the contracts, in short words, I write in it that the client is aware that despite all the efforts that are done to secure a website, there is no guarantee that noone will hack it and steal the data or create any kind of problem. In this case I can't be considered fully or partially guilty of that or be asked for any kind of refund.