Secure software development does not start with a firewall, but with the choices you make at the start of the project. Who is allowed to see what? Where is the data stored? What happens if a password leaks? If you ask those questions early, security is not an expensive extra, but a standard part of the work.
You do not need to be a security expert to make good agreements. In this article you get the key topics and the questions to ask your developer.
Why software security matters for SMEs too
Many business owners think hackers only go after big companies. In practice, many attacks are automated. Scripts scan the whole internet for known weak spots, no matter how big your business is. A small customer portal with weak passwords is then just as interesting as a large system.
If your software holds personal data, you also have to deal with the GDPR (AVG in Dutch). You must take appropriate measures to protect that data, and in certain cases you must report a data breach. For the exact rules, go to a lawyer or check the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). A hacked system also costs more than money. Think of days without a working system, customers you have to inform and trust you have to win back.
Security by design: security from the first sketch
Security by design means building security into the design, instead of adding it afterwards. That is cheaper and works better. In concrete terms it means:
- Only storing data you really need. What you do not store cannot leak.
- Each user only gets access to what fits their role.
- Sensitive data is stored and sent encrypted.
- All user input is checked before the system does anything with it.
- There is a log of who does what, so you can look back at what happened if there is a problem.
Include these points in your list of requirements. You can read how to put that together in writing a functional design.
Checklist for secure software development
Use this list as a basis for your conversation with your developer. Each point needs a clear answer.
- Login: are passwords stored encrypted (hashed)? Is two-factor authentication possible?
- Permissions: which roles are there, and who can see, change or delete what?
- Connection: does everything run over https, including the admin area?
- Updates: how often are the framework and the packages it uses updated?
- Backups: how often, where are they kept, and has restoring ever been tested?
- Hosting: where are the servers and the data? Within the EU?
- Logging and monitoring: does someone get an alert if something strange happens?
- Developer access: who has access to the server and data after delivery?
If you get a vague answer to a question, keep asking. A good developer explains it in plain language, without you having to understand the technology. Write the agreements down, so you can look back later at what was agreed.
Logins and two-factor authentication
Stolen or weak passwords are one of the most common causes of problems. Two-factor authentication helps a lot against this. As well as a password, the system asks for a code from an app or text message. Someone with only your password then cannot get in.
Also make sure the system blocks temporarily after a number of failed attempts, and that resetting a password works securely. For admins, two-factor authentication is really a must. For customer portals you can offer it or make it mandatory, depending on how sensitive the data is.
Updates, backups and hosting
Software is not finished once it is delivered. Every system uses packages made by others, and security holes are regularly found and fixed in them. Without updates, the risk grows every month. So agree up front who does the updates and how often. Also read what web application maintenance costs.
Backups are your safety net in case of a mistake, a hack or a broken server. A good rule: several copies, in a different place from the application itself, and testing now and then whether restoring really works. Your choice of hosting plays a part here too. More on that in hosting for a web application.
Security testing: when do you need a pentest?
A pentest (penetration test) is a test where a specialist tries to break into your system, with your permission. You get a report of the weak spots they found. For a small internal system that is often not needed. If it involves lots of sensitive data, payments or a large number of users, it is wise to have one done before you go live.
In between, you can catch a lot with code reviews, automatic scans of the packages used and good tests. Ask your developer which of these happen as standard.
Common software security mistakes
Many problems are not caused by clever hackers, but by small things that get forgotten. Watch out especially for these pitfalls:
- One shared admin account for the whole team. Give everyone their own account, so you see who did what and can revoke access per person.
- Former employees who can still log in. Make closing accounts a standard part of someone leaving.
- Test data containing real customer data. Use made-up data for testing instead.
- Passwords and keys in emails or chat messages. Use a password manager to share them.
- No agreement on who is responsible after delivery. Then nobody does the updates.
How Violexa builds secure web applications
At Violexa we include security from the first sketch. Hisham discusses with you which data is really needed, which roles there are and who can do what. In the web applications we build, encrypted connections, properly stored passwords and clear permissions are standard.
A custom web application starts from €1,799 excl. VAT (€2,177 incl. VAT) per project. For updates and backups after delivery there are maintenance plans: Silver €179 excl. VAT (€217 incl. VAT), Gold €299 excl. VAT (€362 incl. VAT) or Platinum €699 excl. VAT (€846 incl. VAT) per month. The first 12 months are fixed, after that you can cancel monthly by email with 1 month's notice.
Want to know how secure your current system is, or want something new built? Book a free quickscan. In 30 minutes, online or on site, we discuss your situation. Afterwards you get short written advice with a price estimate, with no obligation.
Frequently asked questions
How do you get secure software built?
Include security in your requirements from the start. Agree how logins, permissions, updates, backups and hosting will be handled. Ask your developer for a concrete answer on each topic.
Does a customer portal need two-factor authentication?
For admins it is really a must. For customers it depends on how sensitive the data is. With financial or medical data, it is wise to make it mandatory.
What is a pentest and do I need one?
In a pentest, a specialist tries to break into your system with your permission. For small internal tools that is often not needed. With lots of sensitive data or payments, it is wise.
What should I do if there is a data breach in my software?
First make sure the leak is closed and find out which data is involved. In certain cases you must report a breach involving personal data to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If in doubt, ask a lawyer for advice.
