Web application security standards/certificates

Question

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they care about certificates. So my question is:

What are the most recognized, most valuable certificates that a web application must have?

In short, about the project and technical details:

• .NET 4.5
• CMS SaaS based on Azure
• Users will be able to input a vide variety of data (uploading files as well)
• Users will be able to create their own plugins/modules
• It will eventually be open sourced (not soon tho)

Also, I'm interested in the certification procedure, how does it work? I imagine I'll have to get the whole application pen-tested, so who does the pen-testing, certificators?

Thanks!

This is my first post on security.stackexchange, so don't be too harsh on me :).

Answer 1

There aren't really any "certifications" for web-apps. The closest I can think of is PCI-DSS, but the web app side of it is minimal - it's largely applicable across infrastructure and business processes, and heavily focuses on card payments.

If you're specifically looking for certifications, then web app development certs might be a good choice for a developer to get. Note that they apply to the person doing the development, not the application. A few things you can get certified for/as that come to mind are Microsoft SDL and GIAC GSSP (there's a .NET one).

In terms of maintaining security on a site, you'd usually get the site pentested by a professional organisation, review the security issues, then fix them. You don't really get any magic shiny certificate for doing this, but you do get to bask in the nice warm glow of knowing that you took security seriously. Plus your customers probably won't have to sue you for getting breached, which is always nice.

Pentesting is usually done by security consultancy companies, but recommending specific companies is outside of the scope of this site - there's no one answer, and it's largely geographically dependent.

If you're going about this so that you can add a big banner to the site saying "we're secure!", I think you'd be much better off forgetting about certifications and just focus on being transparent. Giving out details about how you do your security (e.g. password storage mechanism, account recovery policies, etc.) is the ultimate form of reassurance to a user, because it shows that you're confident enoguh to give that information out, and allows for peer review.

Answer 2

The most valuable certificate is an SSL certificate. Jokes aside, this is a question that merits the universal answer...It depends. Specifically in this case, it depends on who your target audience is. Many large companies want to see ISO 27001 certification. If you're targeting E-commerce, they're going to want to see PCI certification. Healthcare in the U.S., HIPAA certification. U.S. Government entities, FISMA compliance. Other types of organizations in other geographical areas, and it could be something else entirely.

So, rather than boil the ocean, I'd try to focus on who you intend your initial market is going to be, and figure out what certification (if any) matters to those folks, and worry about that.

Answer 3

There aren't certificates I know of to validate a web application but rather certs for processes e.g. you could have your development cycle certified to ISO 27001. You could also follow OWASP to ensure your doing the appropriate vulnerability testing and adhering to a secure development lifecycle.

As you're providing a SaaS, you could go through the Cloud Controls Matrix from the Cloud Security Alliance and submit your responses to their STAR (security, trust and assurance register) registry. You can review other SaaS providers answers for assistance in the process.

There are lots of organisation who do penetration testing - try to get testers with recognised certifications (CREST, CHECK, Offensive Security etc).

Another thing you can do is have static or automated analysis performed on your code and have this stated on your site in a security section to show progressive security on your behalf.