|
Security is not an option.
You have many choices in designing and implementing an Internet system; forgetting about security is not one of them. If you fail to address security requirements, you risk everything from the theft of customer data by hackers to a complete shutdown of your site.
Proper security requires finding a balance between an acceptable level of risk and the usability of the system. It has been said that the only computer that can't be broken into is one that has the power turned off. While such a computer is certainly secure, it is not very useful. At the other end of this spectrum is a system with no security at all. Although easy to use, such a system can be hacked by almost anyone.
The right balance between security and usability will vary depending on the intended use of your Internet system. This can be illustrated by looking at the Web access security models for three different types of Web sites: General Audience News, Personal Banking and Military Intelligence.
General Audience News Web Site
By definition the site needs to be accessible to anyone on the Internet. Access to the Web site content needs no authentication security at all. Of course there will be standard network security such as firewalls.
Personal Banking Web Site
Financial records are very sensitive and therefore strong security is required. However, the user population is very large and is generally not highly technical. Therefore, a middle of the road approach is taken. While strong encryption and Secure Sockets Layer (SSL) are used for transmitting the information over the Internet, user authentication is handled with easy to use usernames and passwords.
Military Intelligence Web Site
Security is the primary concern and outweighs cost and administrative concerns. In this example, the number of users on the site will be fewer than on the banking site. Therefore the extra cost of providing Digital Certificates to each user is acceptable. The digital certificates will also require training in their proper use, which is also an acceptable cost in operating this site. This Web site is also a candidate for a secure Web portal, which would allow users to securely connect to their desktops and email behind the firewall.
Internet systems have an array of security requirements. As a bare minimum, this will include firewalls for the network, encryption for data and communications, security polices for employees and physical security for the building itself. WaterWare will assist you in establishing the proper level of security for your Internet system.
|
