Web Commerce Security Design and Development

CHAPTER 9

Certification: Your Assurance

Two of the fundamental activities in securing Web commerce systems are the proper application of the determined security controls and the verification that these controls are, indeed, working as expected to protect the system. The latter endeavor is known as assurance.

More formally, assurance is defined as the measure of confidence that the security features and architecture of an information system accurately mediate and enforce an organization's information system security policy. A number of different approaches and methodologies have been developed to evaluate assurance. These techniques range from formal methods to probing and testing a network for vulnerabilities.

The primary assurance methodology is certification and accreditation (C&A).