• Skip to primary navigation
  • Skip to content
  • Skip to primary sidebar
  • Skip to footer

Sucuri Blog

Website Security News

  • Products
    • Website Security Platform
    • Website Firewall (WAF)
    • Enterprise Website Security
    • Multisite Solutions
  • Features
    • Detection
    • Protection
    • Performance
    • Response
    • Backups
  • Partners
    • Agency Solutions
    • Partners
    • Referral Program
    • Ecommerce
  • Resources
    • Guides
    • Webinars
    • Infographics
    • SiteCheck
    • Reports
    • Email Courses
  • Immediate Help
  • Login

How to Secure Websites for Clients

December 8, 2016Dre ArmedaEspanolPortugues

110
SHARES
FacebookTwitterSubscribe

In our last webinar, How To Account For Security With Customer Projects, I spoke about maintenance and sustainment contracts – specifically how to use them to better account for client website security.

In this post I will touch on some of the key areas in a project’s lifecycle that can be leveraged to build stronger client relationships, while also providing an opportunity to expand your revenue potential through the introduction of services like security.

Expectation Management

Have you ever been involved in a project where, from the onset, some of the stakeholders want to be the next Facebook? Then you come to find out the actual decision maker really wanted something more like Twitter? Yeah, me too!

client expectations for website security

Alignment is important from beginning to end. It’s hard to always stay aligned with your clients, but seriously important to the success of a project.

To account for this, expectation management needs to be something you start from the very first discussion. You need to continue setting expectations through the end of your engagement with your clients. I think there are a few very basic questions you need to ask yourself when first scoping a client project:

  • What does success mean to you as the agency with the project?
  • What does success mean for your client?

As an agency, you realize that success surpasses the end of the project. It’s not just about scoping the project, developing the solution, and watching it go live. Some could argue this is just the beginning and the real work begins after the deployment.

It’s important to introduce the importance of life beyond the launch early in the process. How often have we worked with a client who is unable to see the forest through the trees? They have the deployment date, as if it was some magical date where everything stops, only to find out that when things are live the real work begins.

Think about hosting changes and issues, new features, updates to existing features (things never work the way everyone first thought), and of course, security.

Too often, when working with organizations we find that security never made it into the conversation at all. In the 11th hour it becomes a requirement that now you, the agency, is being held accountable for. Worst yet is when the conversation is introduced after a compromise, months after a deployment. To account for this, I recommend using a process similar to how you design elements and feature requirements; security needs to be another thing that you introduce early and often.

security in client website projects

The most important questions you want to be mindful of:

  • How will security be handled?
  • How will backups be managed?
  • Who will be responsible in the event of an incident?
  • What is their general position in regards to security?
  • Will they have to work with an internal security team? What does that interface look like?

Granted, these are not all questions that have to be introduced on the first call. It is a conversation that needs to happen, early and often.

The Security Paradox with Agencies

Security to me has overlap with maintenance and sustainment, for obvious reasons like updates, site performance, and site availability. I also think security is a very important stand alone thing that needs to be included at every phase of a project, not just in maintenance and sustainment engagements.

So the next question is: When do you introduce the concept and how can you help your client manage their website security with them for the life of the site?

I encourage agencies to make security a requirement and the implementation of a security plan part of their project architecture. During the build, formalize your requirements and the client requirements. Educate them on the importance of where the site is developed and where it will be in production. Here are some other considerations:

security issues for dev and design agency clients

  • What are the security controls in place to protect the entire stack?
  • Who has access to what and when during the project?
  • Who is responsible for each area of security during and after the build?
  • Make hosting recommendations
  • What are some of the things you should be considering?

It’s never too early to talk about security in the relationship. From initial engagement through hand off to their production environment, you have the opportunity to socialize security and how you can help sustain their site. What I have found that works well is talking through the entire lifecycle during the initial discussions with a potential client.

For example, you have an initial discovery call to talk at a high level about what they want. This is a great opportunity to introduce how you work. Explain the estimate process all the way through deployment from QA to long term maintenance. Introduce your stance on security and its importance. You’re setting expectations from the beginning and recommending the long term as responsible partners. This gets your client thinking about all these moving parts and makes your job of adding maintenance/sustainment to the contract a bit easier to talk about.

Now that you’ve recommended from the jump, include language around security in your proposals / contracts. I liked adding a whole section talking about our recommendations and why they’re so important, specifically highlighting areas of responsibility once the site goes live. I also liked noting that security is important not just during the build, but also something that’s part of a sustainment program.

Another thing I would do is include security solution pricing as a service for the site once it is launched in the estimates. I would break it down into the key areas like monitoring, protection, availability, backups and incident response.

If you need help thinking through this process engage our team and inquire about our new plans built for agencies. These plans allow you to partner with us and extend our services to your audience directly. There are referral programs, and direct integration opportunities that will help you account for some of the recommendations above. You can also read case studies from agency owners who recommend Sucuri for client website security, including WebMechanix, Nicely Built, and Savvii.

110
SHARES
FacebookTwitterSubscribe

Categories: Security Education, Website SecurityTags: Best Practices, Secure Development

About Dre Armeda

Dre Armeda was Sucuri’s founding CEO and Co-Founder who helped start up the company in 2010. Today, Dre is Sr. Director of Technical Program Management and serves as Head of Technical Program Management (TPM) for GoDaddy's Partners Business. As head of TPM, Dre leads the PMO and Program Delivery Teams, ultimately driving all the program management functions and supporting our partners. When Dre isn't executing strategic initiatives at GoDaddy, you can find him on the mat training in Jiu Jitsu as a Carlson Gracie brown belt. Connect with Dre on Twitter.

Reader Interactions

Primary Sidebar

Socialize With Sucuri

We're actively engaged across multiple platforms. Follow us and let's connect!

  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Instagram
  • RSS Feed

Join Over 20,000 Subscribers!

Footer

Products

  • Website Firewall
  • Website AntiVirus
  • Website Backups
  • WordPress Security
  • Enterprise Services

Solutions

  • DDos Protection
  • Malware Detection
  • Malware Removal
  • Malware Prevention
  • Blacklist Removal

Support

  • Blog
  • Knowledge Base
  • SiteCheck
  • Research Labs
  • FAQ

Company

  • About
  • Media
  • Events
  • Employment
  • Contact
  • Testimonials
  • Facebook
  • Twitter
  • LinkedIn
  • Instagram

Customer Login

Sucuri Home

  • Terms of Use
  • Privacy Policy
  • Frequently Asked Questions

© 2022 Sucuri Inc. All rights reserved

Sucuri Cookie Policy
See our policy>>

Our website uses cookies, which help us to improve our site and enables us to deliver the best possible service and customer experience.