 | ||
A trust seal is a seal granted by an entity to website or businesses for display. Often the purpose is demonstrate to customers that this business is concerned with security and their business identity. The requirements for the displaying merchant vary, but typically involve a dedication to good security practices or the use of secure methods for transactions or most importantly verified existence of the company. Trust seals can come in a variety of forms, including data security seals, business verified seals and privacy seals and are available from a variety of companies, for a fee. A Trust seal can be either active or passive. Most seals are validated when they are created and remain so for a specific duration of time, post expiry of which the business/process has to be re-validated.
Contents
Privacy Seal
A privacy seal outfits a company with a privacy statement suited to its business practices. It also helps the company identify potential privacy threats that would otherwise go unnoticed.
Business Practice Seals
These are seals that endorse an operational practice of a business. For example an endorsement of the manufacturing quality practices of the company. Privacy seals are a subset of this category but popular enough, specifically with online retailers, to be mentioned separately.
Business Identity Seal
A business identity seal, also known as a Verified Existence Seal, is one which verifies the legal, physical and actual existence of the business by verifying multiple parameters such as statutory details, contact details, management details, etc. Verified existence Trust seals add weight to the profiles of the deployers and boost confidence of prospective clients. A major benefit of a verified Trust seal is that it represents due diligence by the grantor before granting a certificate for the business.
Security Seals
Security Trust Seals are the most popular type of trust seal verification. There are two different types; Server Verification and Site Verification. Server Verification services perform daily scans on the hosting server. These scans check to make sure patches have been applied or that the server is otherwise not vulnerable to attacks. Website Verification services ensure that customers are protected under normal circumstances by testing for common vulnerabilities such as XSS and SQL Injection.
Criticisms
Third party verification from a reliable source and a strategically placed trust seal may assure customers about the safety and security. Some trust seals, such as McAfee Hacker Safe, however, have been criticized as not doing enough to protect the security of visitors to a site such as because they intentionally mark as 'Hacker Safe' websites known to McAfee to have an XSS vulnerability . This is possible because most seals are a simple image that a hacker can simply copy and paste onto their own site. Such lapses highlight the importance of anti-XSS protection security measures. Trust seals can give a false sense of security as they are awarded at a certain point of time, unless the website is scanned on a daily basis and the scan date is displayed. When a site is not scanned daily, a change in technology and loopholes are not updated along with the trusted seal, so it doesn't represent flaws in the updated technology. The iconographical value is too high to mislead customers unaware about these changes. The FTC has fined fraudulent seal companies that provide no real security benefit.
Examples
As of 2005, in the US market the BBB On-Line, TrustE, Symantec, ScanVerify and WebTrust were generally recognized as significant players. Also notable are: GeoTrust, DigiCert, Norton, Comodo and MerchantCircle. A good example of a Business Practice Seal is from TrustMile. CDSBureau Trust Seal is unique among all trust seals because it certifies businesses that ensure security of customer confidential data kept in digital, paper, or any other possible form. CDSBureau is free and comes with privacy, cyber, and data security trust.
Each of the above offers a "For Fee" annual subscription service, allowing the Trust Seal to be placed on a subscriber's website for the subscription period.