Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list myself, but I am hoping there is something standardised, something independent of me that my client and the users of our site will appreciate more than just something I compiled.

share|improve this question

migrated from Feb 20 '12 at 21:30

This question came from our site for professional and enthusiast programmers.

up vote 3 down vote accepted

It sounds like you might be looking for something like the OWASP ASVS. It defines four levels of rigor, each of which has an associated set of verification activities. Once a client has decided the level at which their application should reside, you will have a concrete list of security activities that should be performed to get to that level.

share|improve this answer
Very interesting looking project. Lots of reading for me. – ProfK Feb 17 '12 at 12:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.