Black Box / White Box

I have been asked to start considering developing a web-based customer frontend for our application.

That doesn't phase me.

What does is that the application database has over 1.5m customer records and I *really* don't want to be in the chair if some bugger manages to hack into the system.

I want to put together a prototype and get someone to do some back box / white box testing to see how robust the architecture is.

So, to the question(s)

a) how do you handle customer security ?

username / password ?

https

certificates ?

otp ?

b) do you know of a reputable organisation that handles this sort of test ? I quite obiviously don't want to hire someone I found on the net, who says "yeah, it's all ok", only to hack into the systems later because he knows all the weaknesses

c) what sort of software do you use ?

http server

O/S

firewalls

etc

many thanks !