NCSA announces Web Site Certification Program.

NEW YORK--(BUSINESS WIRE)--Aug. 1, 1996--The National Computer Security Association (NCSA) Thursday announced its Web Site Certification Program.

Under the program, web sites (whether managed internally by an organization or through an Internet Service Provider) can be tested for compliance with NCSA Labs' computer security guidelines for Web Sites.

The NCSA Web Site Certification program will lead to both improved security and improved trust for visitors to web sites on the Internet. NCSA Labs, with input from dozens of independent experts, has developed a suite of criteria which Web site managers can implement to significantly reduce risk. Sites which appropriately address all of these criteria can apply to NCSA Labs to be tested and certified. NCSA Labs remotely tests the site for compliance with many of the criteria, and for resistance against common hacking techniques. The program specifications were co-developed by NCSA and Georgia Tech Research Institute, with additional input from independent security experts.

In addition to remote testing, NCSA staff and its Certified Web Site Partners also performs on-site security assessments to ensure compliance with additional security criteria. Sites which pass testing and certification will display an NCSA Certified Web Site icon on the home page. If an end-user clicks on this icon, they are linked automatically to NCSA's Web site where lists of all certified sites and current certification criteria are maintained. As the certification criteria evolve periodically, NCSA labs will perform random checks on certified web sites to ensure compliance. NCSA will partner with Ernst & Young LLP to complete the on-site portion of the certification program.

NCSA Web Site Certification will improve web site security by addressing a full range of computer security issues. "No single vendor or product can address the global problem of security on the Internet. But certification of Web Sites will lead to both a significant reduction in risk as well as an improved perception of security across the net," said Peter Tippett, president of NCSA.

NCSA is an independent organization which facilitates interchange among end users, industry experts and vendors on information security, ethics, and reliability. NCSA has more than 1600 corporate members who represent a wide range of commercial, government, and vendor organizations.

Quotes and References:

"NCSA's Web Certification Program is one of the most practical and effective ideas around for raising the general level of security on the Internet." --Benjamin Wright, Author, The Law of Electronic Commerce (214-526-5254)

"Especially in light of the Web's exponential rate of growth, NCSA's Web Security Certification program is a boon to the international Internet community. Although certification cannot guarantee that particular servers are completely secure, it does clearly indicate whether a site has met the criteria necessary for building and maintaining a secure Web infrastructure." --Larry J. Hughes Jr., an Internet Security Engineer, author, and lecturer (317-253-7378)

"By being certified, a Web Site will be perceived as a very low risk to the insurance industry thus enabling them to purchase broad coverage at a reduced rate." "There are many sites who won't realize what they are doing wrong until they see (NCSA's) requirements. Even if they don't get certified, it will at least make them think hard about what they are doing." --Steven H. Haase, Senior Vice President, Hamilton Dorsey Alston Company (770-850-6670)

"We are pleased to support the development and use of standards as a tool in improving the security of the Internet." --Dr. Myron L. Cramer, Principal Research Scientist, Georgia Tech Research Institute (404-894-7292)

"Just as the Web is becoming a major conduit for commerce, issues of privacy and threats of malicious code have become increasing concerns of everyone on the Internet. Users are looking for assurance that the sites they visit meet reasonable standards for security and trust. The NCSA, with its extensive experience testing information security products, is clearly the organization to take the lead on this much needed task."-- Winn Schwartau, President Interpact, Inc., Infowar.Com., author of Information Warfare and co-author, The Complete Internet Business Toolkit. (813-393-6600)

"As a WEB Site developer, it's important to let users know we're serious about the Internet and security. This program helps us do both." -- John G. Sancin, President, Market.al. Inc. (216-524-2227)

"No single vendor or product can address the global problem of security on the Internet. But certification of Web Sites will lead to both a significant reduction in risk as well as an improved perception of security across the net." --Peter Tippett, President, NCSA. (717-258-1816 x213)

"NCSA Certification is a great first step that companies can take to make their web sites secure." --Scott D. Ramsey, National Director Information Security Services, Ernst & Young LLP (216-737-1213)

"Security remains a major concern for many users of the Internet," said Michael S. Karlin, President and COO of Security First Network Bank, the World's first Internet bank (404-679-3201). "The NCSA web site certification program is an excellent first step in recognizing secure Internet sites, such as Security First Network Bank, and allowing consumers to easily identify those sites."

"NCSA's active role in making the Internet a more secure medium for electronic commerce is commendable. A third party, unbiased, certification of secure products, including Web Sites, establishes a level of credibility which is essentially non-existent today in the commercial markets. Any manufacturer can claim their product is secure and, unfortunately, that claim's first challenge comes after it is in market use. What NCSA is doing, is giving the market a level of comfort with respect to manufacturer claims. If the product is stamped 'NSCA Certified' you can trust it has passed a certain level of test and evaluation. We all know that no product is 100% secure, but it can be tested against known vulnerabilities, and that is what the Web Site Certification is all about. There are many electronic commerce packages out there claiming to secure your Web Site and related transactions. Many of these products are based on the same underlying encryption technologies. What NCSA is testing goes beyond the encryption mechanisms and investigates potential vulnerabilities like Denial of Service attacks, probability of Down-Time, potential for Virus migration, Data Integrity, etc. This process is definitely a step in the right direction." --Mark Mercer, President, TECHMATICS (813-887-3488)

"The NCSA Certified Web Site program is a great first step to improving security on the Internet. This program will establish the foundation for self regulation of the industry while deterring government regulation." --Kevin O'Connor

Other People who are informed and may comment about NCSA's Web Certification Program:

-- Patrick Taylor, Internet Security Systems, Atlanta GA (404-252-7270) plus Justin Potts, On Technology (617-692-3226)

-- Rick Hulett, Sprint - Western Operations, (541-387-9030) plus Emma Rosen, Pilot Network Services, (510-433-7851)

-- Brian Cohen, Technologic, (404-843-9111)

-- John Kirkwood, Merck & Company, (201-703-7667)

Technical Specifications for Web Site Certification Program:

The National Computer Security Association establishes and manages information security-related certification programs. Many Information Technology managers believe security concerns and privacy issues are major factors inhibiting full business use of the Internet. The NCSA Certified Web Site program provides assurance to web users, and also to the organizations represented on web sites, that these sites meet minimal standards for a range of logical and physical security issues. By implementing the methods, procedures, policies and other criteria required to achieve NCSA Certification, a site and its users can expect significantly reduced risk of down-time, intrusion, tampering, data loss, hacking, data theft, and other security risks compared with sites which are not NCSA certified.

Criteria Required to Achieve an NCSA Certified Web Site:

-- The web site must withstand network based attacks. This can be accomplished by utilizing a NCSA Certified Firewall, a filtering router whose policy prohibits all protocols which are not necessary to business operations, or other appropriate security measures.

-- The Domain Naming Service entries for all Universal Resource Locator (URL) referenced systems comprising the site must be resolvable, both as a Fully Qualified Domain Name, and as an Internet Protocol (IP) address, and the InterNIC contact information for the site's domain name must be accurate.

-- Logging of the connecting IP addresses, date & time, page(s) being accessed, date & time of each secure connect and disconnect, and denials of access/unauthorized access attempts must be maintained for users accessing the Certified web server.

-- A generally accepted encryption mechanism (i.e., SSL or SHTTP) must be used for sensitive data transmission.

-- A person designated as the site's "Common Gateway Interface (CGI) evaluator" must examine and evaluate all CGI scripts and programs which are accessible on the systems comprising the site.

-- A person designated as the site's "Client Executable (CxE) evaluator" must examine and evaluate all CxE's which are accessible on the systems comprising the site.

-- Pages containing or accepting sensitive data must be non-cacheable.

-- Persistent Client State mechanisms (e.g. Cookies) must not be used to store sensitive data.

-- The web site server must meet various physical and logical security checks (i.e., physical locks, access controls, back-up procedures, etc.).

-- Any "back-end" transaction process must be documented, and available for review.

For further Web Site Certification information contact: Larry Bridwell, NCSA Sales Associate, 10 S. Courthouse Ave., Carlisle, PA, 17013, [phone] Ext. 262, FAX [phone], e-mail: [e-mail], www: http://www.ncsa.com. -0-

NOTE TO EDITORS: NCSA is a registered trademark of the National Computer Security Association. Other brand and product references herein are registered trademarks or trademarks of their respective holders.

CONTACT: NCSA, Carlisle

Kevin J. Stevens, 717/258-1816 ext. 224

Fax: [phone]

e-mail: [e-mail]

or

Network Associates, Provo, Utah

Amy Neuberger, 801/373-7888

e-mail: [e-mail]

or

Cheryl Snapp, 801/373-7888

e-mail: [e-mail]