Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any labels that an SaaS webhost could claim ?

For example, a web page with valid XHTML can claim "W3C Valid XHTML".

For a webapp, it is important to have HTTPS because this will ease thrust (although in practice it just temporarily hardens hacking).

Are there other equivalents about server security ?

What standards, labels, norms could a classic https webapp saas host claim for commercial purposes ?

share|improve this question

closed as off topic by ceejayoz, Andrew M., Zoredache, Sven, Tim Brigham May 14 '12 at 20:33

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

If I go to a secured web site the only thing that matters to me is the SSL certificate validation. It's about trust. Affixing some security label, logo or certification to your site is only meaningful to me if I know what they are, what they stand for, how they're achieved, and trust them. – joeqwerty May 14 '12 at 18:22
If you just want a "label" make one up. If you actually want to be secure, go secure your server - after all the "label" doesn't mean anything. – Coops May 14 '12 at 18:29
@joeqwerty I know people who've changed their favicon to look like a browsers secure padlock! – Coops May 14 '12 at 18:33
There are a ton of labels you could claim, albeit worthless as others here have referenced. Are you trying to achieve a goal or just create a toolbar like certificate list on the website? Edit your question to include your intention and you'll likely get an answer. – Matthew Reid May 14 '12 at 18:40
up vote 4 down vote accepted

If you handle credit card information there is the PCI-DSS standard (Payment Card Industry Data Security Standard, often just called PCI). It specifies a dozen requirements that all companies with payment card data must meet. It is quite controversial (see the linked Wikipedia article).

ISO/IEC 27001 is another certification that is meant to make security practices auditable and certifiable.

Although it's definitely a good idea to see what you can learn from standards like these, just like with HTML validation, there is in my opinion little value to your site's visitors. The standards specify how an organization must do things, but are easily circumvented if the organization chooses to. In other words, they're nice on paper. Most customers won't know what they are and what it means if you put an "I'm certified" logo on your site.

Your best bet is to actually do things properly, and build an image of reliability and trust. Word of mouth spreads fast on the web, both if you do things well and if you do things badly.

share|improve this answer
Thanks for the links, great answer, reusable without a modification. I'd leave the topic open for a couple of days and try to gather more information, but as it's closed (??) I might as well accept the only answer. So, thanks again, keep up the good work ! – jpic May 14 '12 at 21:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.