Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 4 down vote favorite

I have an ecommerce website and I recently came accross a web page that talks about cyber crime and this has got me wondering what website security verification means.

I saw this and I am a bit worried about credit card theft on my site. Does any one know what the site means by wesite verification. How may I similarly verify my website to prevent such fraud cases.

Are ther companies out there that offer this kind of service

share|improve this question
In addition to the link to security.stackexchange.com in my answer below, there are a range of questions and answers over there that could help you assess your risks and begin to define a plan to improve yoursecurity. – Rory Alsop Apr 15 '11 at 9:24

2 Answers

up vote 3 down vote accepted

Security certifications are typically based on the results of a penetration test, which gives an indication of how difficult it is for ethical hackers to get past the security controls. Where this testing is done by experienced professionals this can be very useful.

However

  • Any security test is a point in time: a new 0-day exploit could be released the day after the attack and if the site is vulnerable the security certification is effectively useless.

  • For organisations that handle credit card data, PCI-DSS is supposed to certify that you protect your data appropriately, however the inadequacies are demonstrated in the media by famous attacks against PCI compliant organisations (eg Worldpay in 2009) - despite that, there are a lot of good activities described in PCI which you should look at.

So if you are worried about your site, good practice for security generally includes:

  • Risk assess your assets
  • Patch your platforms and your code!!!
  • Training your developers in secure coding - certifying them is useful (see this SANS initiative)
  • Look at the OWASP top ten for the most common attacks and what to do about them
  • Understand what platforms you use, and monitor scurity advisories for those platforms
  • Regular penetration testing - annually, on every major update, on changes to your risk profile or threat landscape
  • A defence in depth approach, so if a particular layer of security fails you will spot it before you are compromised
share|improve this answer
up vote 0 down vote

I'm not an expert, but to me its nothing but a bit of a sham, users want to see that a website is secure, so owners pay money to get 'verified'

some are Trust Guard, Mcafee and truste

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.