I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list myself, but I am hoping there is something standardised, something independent of me that my client and the users of our site will appreciate more than just something I compiled.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
migrated from stackoverflow.com Feb 20 '12 at 21:30
|
It sounds like you might be looking for something like the OWASP ASVS. It defines four levels of rigor, each of which has an associated set of verification activities. Once a client has decided the level at which their application should reside, you will have a concrete list of security activities that should be performed to get to that level. |
|||
|
