3

Let's say that you have built an application. It doesn't really matter which type of application but the security of the application is a very important feature.

How do you proceed to gain some credibility that your application is secure?

Of course, you could just say "yes it's very secure because it uses state of the art encryption (plug algorithm name here) and ..." but that's just hearsay. You need some kind of better proof right? So, what can help to convince others that your application is secure?

5

There are several popular approaches to this.

First, is getting an independent, 3rd party auditor to vouch for you. This is most effective if it is done by a well-known name (e.g. get Troy Hunt to vouch for you, or Charlie Miller if you're on Apple's OS), or a huge household name (if your target market are non-technical / non-security folk) - e.g. E&Y, or Accenture.

Taking this a step further, you can get accredited by a 3rd-party regulation or certification. This is possibly the most popular, and IMO likely the least effective.
This could range from PCI-DSS (which you would have to do anyway if you handle credit cards), through to the infamous "HackerSafe" (I think its called "McAfeeSECURE!!1!" now). Either way, it doesn't actually show any real quality, and in some cases is easily spoofed. cough cough


There is a third option, which is much more difficult to do right, but a lot more effective particularly with those that most understand what this means. This option requires two steps:

  1. Actually being secure, and having a strong process to ensure this;
  2. Sharing details of that process, and what it actually entails.

Being secure is a much wider question and out of scope of this answer; sharing the details is obviously much less common in big corporates, though I am starting to see this in more startups and even larger, but technical, enterprises.

This could include information about your SDLC; explanations of your security requirements; technical details about your implementation; possibly an open bug bounty, but at least a statement of response to researchers (and follow through!); maybe even opensourcing your codebase, if relevant; and so on and so on.

Obviously you would need an experienced security expert to help you get your application to be secure; a very good one could help you "open the kimono" in a productive, yet secure, manner. Done right, this could even increase marketing efforts, and still not reveal any sensitive details that could help an attacker bypass your controls.

Interestingly often old-school security pros (especially those with a corporate background) will insist on not revealing anything; but not only should this not at all increase your risk or attack surface (if done right), it can definitely help allay any potential customer fears or worries, especially if they understand what they're reading.
Just make sure you have someone who knows what they're doing.

2

By far the easiest way to gain credibility:

  1. Put together a secure app.
  2. Publish the source code.
  3. Use feedback and criticism to improve app while building credibility.

Security-focused software that's actually somewhat secure, like Signal Private Messenger or SELinux have this in common, and it is one way to gain credibility.

Short of allowing your code to be audited and vetted, marketing can generally generate a sense of credibility and security for the non-security minded market(most of the market).

  • 1
    Definitely not easy, even starting from #1 ;-) . But beyond that, publishing the source is often not enough, and would only help in the small case where it already garnered enough attention, from the right kind of people. As your examples, Signal of course benefited from that, for those reasons. – AviD Jan 26 '17 at 22:31
  • 1
    @AviD "test of time" is kind of mandatory for verifying security - it first needs to get attention and only long after that many people have looked at it for a long time it can be properly judged as secure and not. You can't get around that, for any new system in the beginning you can have only unverified claims and it needs to look promising despite not (yet) having a good reputation. – Peteris Jan 26 '17 at 22:54
  • @Peteris that is only true if you're just sitting around waiting for people to come review your code. Instead, you can be proactive about it, and hire experts (the right experts) to intentionally review everything you're doing - not just the code, also ensure you're doing it right in the first place. – AviD Jan 27 '17 at 13:06
1

Publicly offer to cover your customers for any loss. Lifelock, for example, offers $1 million in coverage if your identity is stolen while you subscribe to the service.

Now, maybe you don't have a million dollars. But you can get a cybersecurity insurance policy by paying a fee (just like any other insurance policy). I'm guessing that the insurance company will wish to inspect your code and demand that it meet certain standards, or at least hold it in escrow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.