Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they care about certificates. So my question is:

What are the most recognized, most valuable certificates that a web application must have?

In short, about the project and technical details:

  • .NET 4.5
  • CMS SaaS based on Azure
  • Users will be able to input a vide variety of data (uploading files as well)
  • Users will be able to create their own plugins/modules
  • It will eventually be open sourced (not soon tho)

Also, I'm interested in the certification procedure, how does it work? I imagine I'll have to get the whole application pen-tested, so who does the pen-testing, certificators?

Thanks!

This is my first post on security.stackexchange, so don't be too harsh on me :).

share|improve this question
    
It's hard to tell if you might be confused. Certificates in the IT.Sec sense are a cryptographic key that validates your identity. There is no testing or reviews to get them in the sense you are thinking of. Instead, a trusted third party simply verifies your identity (either by simply verifying you own the domain you claim or in more elaborate cases, by reviewing your business documentation) and then issues you a certificate that you can use to prove that you are you to the browsers of those who visit your site. Certifications like you are describing only exist for specific use cases. –  AJ Henderson Apr 30 '13 at 15:21
    
It was hard to come up with another word for it. I had in mind certification as in "verification licence from trusted supplier, which states that your app is secure". –  Ernestas Romeika Apr 30 '13 at 16:04
1  
I think you might be looking for something that doesn't exist in the sense you are looking for. Threats change too often for a certification like this to have much meaning and most of the certifications that do exist rely on self certification due to the need to adapt to the constantly shifting landscape. There is no guarantee that what is secure today will be secure tomorrow and without proactive review and updates, it almost certainly won't be. –  AJ Henderson Apr 30 '13 at 16:22

3 Answers 3

There aren't really any "certifications" for web-apps. The closest I can think of is PCI-DSS, but the web app side of it is minimal - it's largely applicable across infrastructure and business processes, and heavily focuses on card payments.

If you're specifically looking for certifications, then web app development certs might be a good choice for a developer to get. Note that they apply to the person doing the development, not the application. A few things you can get certified for/as that come to mind are Microsoft SDL and GIAC GSSP (there's a .NET one).

In terms of maintaining security on a site, you'd usually get the site pentested by a professional organisation, review the security issues, then fix them. You don't really get any magic shiny certificate for doing this, but you do get to bask in the nice warm glow of knowing that you took security seriously. Plus your customers probably won't have to sue you for getting breached, which is always nice.

Pentesting is usually done by security consultancy companies, but recommending specific companies is outside of the scope of this site - there's no one answer, and it's largely geographically dependent.

If you're going about this so that you can add a big banner to the site saying "we're secure!", I think you'd be much better off forgetting about certifications and just focus on being transparent. Giving out details about how you do your security (e.g. password storage mechanism, account recovery policies, etc.) is the ultimate form of reassurance to a user, because it shows that you're confident enoguh to give that information out, and allows for peer review.

share|improve this answer
    
Re "add a big banner to the site saying we're secure" - hire a lawyer first. –  Vitaly Osipov May 1 '13 at 4:21
    
@agelastic I might be mistaken but I don't think he was being serious about that... –  Terry Chia May 1 '13 at 16:21

The most valuable certificate is an SSL certificate. Jokes aside, this is a question that merits the universal answer...It depends. Specifically in this case, it depends on who your target audience is. Many large companies want to see ISO 27001 certification. If you're targeting E-commerce, they're going to want to see PCI certification. Healthcare in the U.S., HIPAA certification. U.S. Government entities, FISMA compliance. Other types of organizations in other geographical areas, and it could be something else entirely.

So, rather than boil the ocean, I'd try to focus on who you intend your initial market is going to be, and figure out what certification (if any) matters to those folks, and worry about that.

share|improve this answer

There aren't certificates I know of to validate a web application but rather certs for processes e.g. you could have your development cycle certified to ISO 27001. You could also follow OWASP to ensure your doing the appropriate vulnerability testing and adhering to a secure development lifecycle.

As you're providing a SaaS, you could go through the Cloud Controls Matrix from the Cloud Security Alliance and submit your responses to their STAR (security, trust and assurance register) registry. You can review other SaaS providers answers for assistance in the process.

There are lots of organisation who do penetration testing - try to get testers with recognised certifications (CREST, CHECK, Offensive Security etc).

Another thing you can do is have static or automated analysis performed on your code and have this stated on your site in a security section to show progressive security on your behalf.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.