Likelihood of getting this answer: Almost zero. You’re lucky if you can find a company that has trained 10 percent of its application development team. Some forward-thinking software vendors, like SAP, have adopted eLearning and are aggressively training their ranks.

7. What percentage of your software development and testing team is focused on security?

A good answer: Five to 10 percent. Given all the different aspects of software quality (functionality, reliability, performance, usability, accessibility) anything in this range means the vendor is strongly committed to security and recognizes it as an important aspect of software quality.

Likelihood of getting this answer: Zero to 25 percent. Progressive software vendors and development teams acknowledge that security is a non-negotiable business requirement. Others, including on-demand or Software as a Service vendors view security as a cost of doing business because customers demand it.

8. Do you have a dedicated team to assess and respond to security vulnerabilities reported in your products?

A good answer: Yes, we have an incident response team whose job is to determine the seriousness of reported vulnerabilities and work with the product development teams to issue a response to our customers in a timely manner.

Likelihood of getting this answer: 75 percent to 90 percent. Because most software vendors have a way to report and respond to bugs, security defects are easily added to this process. But you should probe as to how (or if) reported security defects are treated differently than nonsecurity defects. Some companies view security defects as just another bug and, as a result, do not elevate them to a higher priority fix.

9. What is your patch release strategy and what tools do you offer for patch deployment?

A good answer: We issue regularly scheduled and fully tested patches to our products each Thursday, if needed. To make patch deployment and management easy, we support the popular configuration management systems such as HP’s CM Patch Manager and Attachmate’s WinINSTALL.

Likelihood of getting this answer: 20 percent. Most vendors don’t offer regularly scheduled releases and even fewer offer fully tested patches. For those who offer both, you need to be aware that the days between public disclosure of a vulnerability and issuance of a patch will be longer for vendors who do not fully test patch releases. You need to decide if timeliness of patch or having fully tested patches are more important for your organization. You seldom get both.

10. What methods do you use to inform customers of vulnerabilities?A good answer: Registered customers have vulnerability information disclosed to them immediately, even before a patch is ready. We generally take two weeks between customer disclosure and full public disclosure. Customers can choose their method of disclosure: e-mail, page/text message, or whatever, and all vulnerabilities are also posted to our customer Web portal.