2

Are there any web application security standards that I can use as a baseline for the security related requirements for a web application, web service, and for applications supported/hosted by third parties?

How is security risk managed for web application and what are the preventive and corrective controls that I should expect to see?

Additionally, how can we provide security compliance for web applications?

From my findings I found that most organizations have developed their own standards/guidelines like

Am I mistaken in that there is no universal standard?

Improve this question
0

3 Answers 3

Reset to default
1

In Austria we have a standard more or less written by SecConsult which is loosely based on OWASP documents. You can find more information on it here: http://www.a7700.org/index_e.html

Improve this answer
9

From what I understand there is no 'universal' standard, however several standards do exist that you can use as a point of reference.

These are just a few I know about. The standards you build for yourself will be dictated by the nature of your application and the information is serves/stores. However the above resources should help you get an idea of what things you might want to keep in mind or work into your own standard.

Improve this answer
1
  • There are also regulators like the FFIEC, Monetary Authority of Singapore (MAS), and others. These are generally at a process and procedure level, dealing with how an organization should run itself and its systems. Commented Nov 13, 2013 at 13:12
1

Depending on a specific use case (type of industry, country regulations etc.) a web application may be required to satisfy requirements from a variety of different standards. Some worth mentioning standards are the following:

  • OWASP Application Security Verification Standard 4.0.3
  • National Institute of Technologies Special Publication 800–218
  • International Organization for Standardization 27034
  • Center for Internet Security Critical Security Control 16: Application Software Security

Apart from formal standards you might want to take a look at projects like OWASP Top Ten or CWE/SANS Top 25.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.