Apologies if this in the wrong section, not sure if it should go in Server Fault or not.

I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR perspective, I need to mention some of what we are doing - security is a fundamental part, and selling point, of this project and details will be expected.

So, my question is, how much do we give away without compromising our security. Do you bang on about fw/proxies, nids, hids, honeyd, compartmentalised architecture and watchdogs etc, or just "we're PCI compliant".

I should point out that a fair number of the users, especially early doors, will be security conscious and knowledgable; does being "PCI Compiant" cut it?

2 Answers 2


Focus less on giving a detailed security report and more on answering the user's potential questions.

If your app uses TLS to communicate with the servers, then that's a bullet point for your security page. If you hash your passwords with pbkdf2, there's another. If you store a backup copy of user credentials on a server hosted with Amazon in zone us-east-1a... ok, you can probably see why that detail doesn't really answer your user's questions, but just provides attack information.

With PCI compliance; if you accept credit cards, you're assumed to be PCI compliant. And anyway, PCI is about protecting credit cards, not users. Visa cares about whether you store CVV2s, not about whether you sell customer phone numbers on russian forums. There's a world of difference between true identity theft and credit card number theft, and the Payment Card Industry is only financially liable for the latter.

Instead, you might want to point out certain aspects of the PCI compliance testing that would be relevant to the users. "Security practices and infrastructure rigorously audited by [company name]."

  • Yes, I'll definitely take that approach re PCI. Actually, we don't hold any credit cards, but we do hold bitcoin wallets so are voluntarily doing our PCI mainly for 'user confidence', actually looking at some of the PCI Approved Vendors gives me some bullet points ready to use. I will also bring in an independent auditor as per yours and Rorys suggestion (and to be honest, it would be a good idea anyway).
    – Paul
    Dec 16, 2013 at 11:05

I'd recommend describing some of the measures you use without going into precise detail. Definitely avoid any mentions of semi-snakeoil topics such as "military grade encryption". A statement of PCI compliance would likely provide a level of comfort that you've at least looked at the basics, but might not satisfy very security sensitive customers.

To an extent the problem with describing security technologies you use is that there's a difference between deploying FW/IDS/IPS/etc and deploying them effectively..

As a result, if possible, providing evidence of external review is an option to improve peoples perceptions. For example saying that you have external security reviews of your systems completed on a regular basis covering "x" areas would be a positive step.

Also you could publish executive summary level information from your 3rd party reviews. Some consultancies will charge more for this ('cause if their name is on a published report, their reputation is partially at stake) but it could (if the scope and depth of the assessment is correct) give customers assurance that it's not just you saying how great your security is :)

  • The independent report is a very good idea, I may make that part of our process - an annual independent review. Thanks.
    – Paul
    Dec 16, 2013 at 11:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .