What are the standards for security on the web and web development?

Question

What are the standards that govern security practices on the web and web development? What standards body publishes such documents?

Answer 1

Have a look at OWASP.

The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software.

Answer 2

Most general and apply to any developpement but interesting anyway :

CWE/SANS TOP 25 Most Dangerous Programming Errors

Answer 3

I don't know of any standards governing security practices specifically focussed on web apps, but the ISO27000 family of standards cover information systems in general. Warning: getting hold of a copy of ISO2700x, unless you work for ISO or a university, is not cheap...

Answer 4

It depends on the industry. Credit Cards use the PCI-DSS. The US medial industry uses HIPAA. Cryptographic systems are governed by FIPS-140 which was created by NIST. Then there is the CWE system which is a list of every known vulnerability type.