Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/18/2011
01:59 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Brings TRUSTe Certification To Apps Marketplace

Business users of Web apps should soon be able to better assess vendors' data handling and privacy practices.

Top 15 Google Apps For Business
Slideshow: Top 15 Google Apps For Business
(click image for larger view and for full slideshow)
In an effort to make the cloud more transparent, Google has introduced a TRUSTe data privacy certification program for enterprise Web apps in its Apps Marketplace.

The Google Apps Marketplace opened in March 2010 with over 50 installable Web apps and grew to over 300 a year later. It is a business-oriented version of the Chrome Web Store, launched in December 2010.

Google's goal with the Apps Marketplace has been to simplify the process of Web app discovery, evaluation, and deployment. Businesses that deploy Marketplace apps gain the benefits of Google account single sign-on and access through the universal navigation bar that those with Google accounts see when logged in. Some Marketplace apps also synchronize with Google Apps data.

Such convenience, however, invariably comes with concerns about how these apps handle corporate data. Given the reports of insecure and malicious apps in the Android Market, not to mention ongoing efforts to steal data or dupe users through malicious advertising, it's understandable that business IT managers have asked Google for reassurance about the data handling and privacy practices of Web app vendors.

To address such concerns, TRUSTe has created a certification program by which makers of installable Web apps can make their data and privacy practices more clear to current and potential customers. Certification is free for the first year and $300 for each year thereafter.

"This program, which is optional for vendors, displays a green TRUSTe logo on a certified app's Marketplace listing page as well as search results pages," said Google Apps partner lead Scott McMullan in a blog post. "The logo links then to a certification summary with more specific information about the app."

To be certified, Web app vendors must provide answers to a series of questions to a TRUSTe representative. The questions have to do with how data utilized by a Web app is shared and secured. TRUSTe's certification program is based on privacy frameworks like the U.S.-E.U. Safe Harbor, regulatory guidelines, industry standards, and the expectations of clients and experts.

However, a certification from TRUSTe is not a guarantee of security or proper data handling; it's merely an assessment of whether a particular vendor's self-reported practices fall within industry norms. In the past, TRUSTe has come under fire for being too soft on its clients, which, after all, are paying its bills.

Nevertheless, certifications are important for businesses and vendors, so much so that they're sometimes seen as a competitive advantage. Last month, Microsoft claimed Google wasn't being honest about the status of the FISMA security certification for its Google Apps for Government service, a charge Google rebutted.

Yes, you can stay safe in the cloud. In this Tech Center report, we explain the risks and guide you in setting appropriate cloud security policies, processes, and controls. Download the report now. (Free with registration.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Inside North Korea's Rapid Evolution to Cyber Superpower
Kelly Sheridan, Staff Editor, Dark Reading,  12/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25465
PUBLISHED: 2020-12-04
Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25461
PUBLISHED: 2020-12-04
Invalid Memory Access in the fxProxyGetter function in moddable/xs/sources/xsProxy.c in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25462
PUBLISHED: 2020-12-04
Heap buffer overflow in the fxCheckArrowFunction function at moddable/xs/sources/xsSyntaxical.c:3562 in Moddable SDK before OS200903.
CVE-2020-25463
PUBLISHED: 2020-12-04
Invalid Memory Access in fxUTF8Decode at moddable/xs/sources/xsCommon.c:916 in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVE-2020-25464
PUBLISHED: 2020-12-04
Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger.