Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list myself, but I am hoping there is something standardised, something independent of me that my client and the users of our site will appreciate more than just something I compiled.

share|improve this question
add comment

migrated from stackoverflow.com Feb 20 '12 at 21:30

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 3 down vote accepted

It sounds like you might be looking for something like the OWASP ASVS. It defines four levels of rigor, each of which has an associated set of verification activities. Once a client has decided the level at which their application should reside, you will have a concrete list of security activities that should be performed to get to that level.

share|improve this answer
    
Very interesting looking project. Lots of reading for me. –  ProfK Feb 17 '12 at 12:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.