-4

Are there any labels that an SaaS webhost could claim ?

For example, a web page with valid XHTML can claim "W3C Valid XHTML".

For a webapp, it is important to have HTTPS because this will ease thrust (although in practice it just temporarily hardens hacking).

Are there other equivalents about server security ?

What standards, labels, norms could a classic https webapp saas host claim for commercial purposes ?

Improve this question
6
  • 3
    If I go to a secured web site the only thing that matters to me is the SSL certificate validation. It's about trust. Affixing some security label, logo or certification to your site is only meaningful to me if I know what they are, what they stand for, how they're achieved, and trust them.
    – joeqwerty
    May 14, 2012 at 18:22
  • 1
    If you just want a "label" make one up. If you actually want to be secure, go secure your server - after all the "label" doesn't mean anything.
    – Coops
    May 14, 2012 at 18:29
  • aws.amazon.com/security/#certifications
    – ceejayoz
    May 14, 2012 at 18:30
  • @joeqwerty I know people who've changed their favicon to look like a browsers secure padlock!
    – Coops
    May 14, 2012 at 18:33
  • There are a ton of labels you could claim, albeit worthless as others here have referenced. Are you trying to achieve a goal or just create a toolbar like certificate list on the website? Edit your question to include your intention and you'll likely get an answer.
    – inevio
    May 14, 2012 at 18:40

1 Answer 1

Reset to default
4

If you handle credit card information there is the PCI-DSS standard (Payment Card Industry Data Security Standard, often just called PCI). It specifies a dozen requirements that all companies with payment card data must meet. It is quite controversial (see the linked Wikipedia article).

ISO/IEC 27001 is another certification that is meant to make security practices auditable and certifiable.

Although it's definitely a good idea to see what you can learn from standards like these, just like with HTML validation, there is in my opinion little value to your site's visitors. The standards specify how an organization must do things, but are easily circumvented if the organization chooses to. In other words, they're nice on paper. Most customers won't know what they are and what it means if you put an "I'm certified" logo on your site.

Your best bet is to actually do things properly, and build an image of reliability and trust. Word of mouth spreads fast on the web, both if you do things well and if you do things badly.

Improve this answer
1
  • Thanks for the links, great answer, reusable without a modification. I'd leave the topic open for a couple of days and try to gather more information, but as it's closed (??) I might as well accept the only answer. So, thanks again, keep up the good work !
    – jpic
    May 14, 2012 at 21:21

Not the answer you're looking for? Browse other questions tagged .