Application security

Starting several years ago heightened security concerns made it imperative to define what kind of security was appropriate for each project at the outset, rather than tacking it on at the end or after a breach.

Every system must address the following:

• Authentication: knowing who is accessing the system.
• Authorization: knowing what operations each user is allowed to perform, and on which resources.
• Data integrity: preventing unauthorized data changes.
• Encryption of sensitive data.

The client must also address the following:

• Physical security for the servers.
• Watchful user administration and authorization.
• Vigilant maintenance of the operating system, web server, and infrastructure patches.
• Providing industry standard network security, such as firewalls, virus scans, etc.

The following design considerations are available to protect the client’s site against unwanted and/or unlawful site activity and intrusion, while still maintaining reasonable maintenance cost:

• SSL encryption (HTTPS) for sensitive data transmission.
• Intrusion Detection System with e-Mail Alerts and Log file generation.