Security in a SaaS service

Question

Information Security

Good afternoon colleagues.
We have built a small service here for two friendly companies. They use it, everything is wonderful. The project came out not that too commercial.

A third company comes to us and says, the guys told us that you have such a cool thing, give it to us. It’s like we don’t mind, we almost agreed, but then they start asking strange questions, they say, what about your security, and your data is encrypted?

I am confident in the code, because I am confident in my developers, the mosquito will not undermine the nose. But about encryption ... In general, it's very good to hear some useful links and see tips.

Answer 1

Why HTTPS did not please?
In general, there is no abstract security because there are no abstract hacks. The system can be written quite correctly, but it can break, for example, through one of the services on the server, or even through a hole in the OS.
And I would give only one advice and it does not in any way concern security. Do not do business with this company. Because if the customer starts to endure the brain with muddy questions in the area in which he is not competent from the very beginning, then know that no amount of money will cover you for those adventures on your ass that he will deliver to you.

Answer 2

A very good article is “5 Steps to SaaS Security”.

Answer 3

www.ibm.com/developerworks/en/library/j-saas/index.html