How much security information to publicise?

Question

Apologies if this in the wrong section, not sure if it should go in Server Fault or not.

I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR perspective, I need to mention some of what we are doing - security is a fundamental part, and selling point, of this project and details will be expected.

So, my question is, how much do we give away without compromising our security. Do you bang on about fw/proxies, nids, hids, honeyd, compartmentalised architecture and watchdogs etc, or just "we're PCI compliant".

I should point out that a fair number of the users, especially early doors, will be security conscious and knowledgable; does being "PCI Compiant" cut it?

Answer 1

Focus less on giving a detailed security report and more on answering the user's potential questions.

If your app uses TLS to communicate with the servers, then that's a bullet point for your security page. If you hash your passwords with pbkdf2, there's another. If you store a backup copy of user credentials on a server hosted with Amazon in zone us-east-1a... ok, you can probably see why that detail doesn't really answer your user's questions, but just provides attack information.

With PCI compliance; if you accept credit cards, you're assumed to be PCI compliant. And anyway, PCI is about protecting credit cards, not users. Visa cares about whether you store CVV2s, not about whether you sell customer phone numbers on russian forums. There's a world of difference between true identity theft and credit card number theft, and the Payment Card Industry is only financially liable for the latter.

Instead, you might want to point out certain aspects of the PCI compliance testing that would be relevant to the users. "Security practices and infrastructure rigorously audited by [company name]."

Answer 2

I'd recommend describing some of the measures you use without going into precise detail. Definitely avoid any mentions of semi-snakeoil topics such as "military grade encryption". A statement of PCI compliance would likely provide a level of comfort that you've at least looked at the basics, but might not satisfy very security sensitive customers.

To an extent the problem with describing security technologies you use is that there's a difference between deploying FW/IDS/IPS/etc and deploying them effectively..

As a result, if possible, providing evidence of external review is an option to improve peoples perceptions. For example saying that you have external security reviews of your systems completed on a regular basis covering "x" areas would be a positive step.

Also you could publish executive summary level information from your 3rd party reviews. Some consultancies will charge more for this ('cause if their name is on a published report, their reputation is partially at stake) but it could (if the scope and depth of the assessment is correct) give customers assurance that it's not just you saying how great your security is :)