What strategies are there to prevent possible unwished behavior of external/bought code? [closed]

Question

Closed. This question needs to be more focused. It is not currently accepting answers.

---

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 9 years ago.

Improve this question

I want to start a project, technically based on the code of another project -- a clone. E.g. a forum or an online shop, whatever. I'll buy the code base. But then it's theoretical possible, that the developer/seller is able to manipulate something remote, e.g. export the customer database or just change/delete files with code and make the code useless, if he wants to.

What strategies (maybe best practices) are there to defend oneself in such cases?

Answer 1

The only viable option is a code review by a person competent in detecting such security flaws. This is by no means a cheap process, nor will there be any guarantee of success.

Even teams of people writing and reviewing code designed to be secure often fail to fill every possible security hole, eventually some hacker finds these holes and exploits them. Take for example the heartbleed bug in OpenSSL.

Regardless of it being the developer who has malicious intent or it being a hacker attacking his otherwise good code the same approaches apply. To prevent your customer DB being downloaded put it on a separate layer with it's own security. If the DB server will only provide the web app with one customer at a time and not provide a list then downloading th whole db is very hard.

Hackers do manage to change and delete code on servers. To mitigate this a tripwire system should be used to detect these changes, then the code can be restored from a simple backup.