Security

vinsnash

I'm developing a membership application on VPS with the standard logon ID and password.

The question I'm being asked which I hadn't really thought about yet is protecting sensitive member information. We do have birth dates, SSN, addresses, insurance info etc. When I asked, the VPS provider support starting talking about ISS and certificates and host of other things that mostly related to the hierarchy of web pages and went seriously over my head.

My application is strictly vanilla. There is no HTML, JAVA, etc. that I'm producing. So I'm not sure the ISS and certificate stuff is applicable.

Can someone enlighten me on the issue. I have to present something for the board and auditors before going live with this.

Vins Nash

ninap

hi, what security regulations are you trying to follow?

or do you mean more from a general security and tomcat perspective?

txs, nina 🙂

vinsnash

That's where I'm a "babe in the woods". I suspect asking about something like the security of bank account access or credit card processing. I believe the tip off is the URL beginning with https: rather than just http:

I sort of gathered that I can do that on the VPS by opening "IIS" making some settings etc. What I see when I do that is confusing because I really don't know what I'm doing there or what it will do to my application. Right now I just use the standard AWARE IM URL to access the system.

Vins Nash

tford

I believe Pete (pbrad) has dealt with this with AwareIM. You may want to hire him to help you along with this. I personally don't think it's work the risk of trying to walk through it yourself if it's new territory since you are dealing with SS#'s, etc.

Bryan

For security from the outside world I would suggest using SSL with Tomcat. You can find all of the steps you need for setting this up in the following tips & tricks post.

vinsnash

Thanks for the tip. I was searching the manual for "security" and didn't find much. I've managed to limit access to specific records via roles, access levels, and rules.

I'll see if I can follow the steps. The background workings of the server are alien to me.

Vins Nash

Bryan

One suggestion prior to trying to implement SSL. Back up your entire C:\AwareIM folder. If you run into issues you can simply copy this folder back in and it is as if nothing happened.

vinsnash

Bryan,

Thanks again. What I also need is some documentation on just what this will be doing. I'm not at all sure I understand what certificates are all about or how they work.

Vins Nash

Bryan

Vins,

I don't have any documentation on what SSL is because it is such a common encryption mechanism for the web. If you just need the basic understanding of what it is I would just hit the web. Here is a good brief explanation: http://info.ssl.com/article.aspx?id=10241

Basically if you have ever done online banking or purchased something online you have used SSL. It is what differentiates a HTTP site from a HTTPS site. SSL serves as a hand shake so to speak between the browser and the server prior to sending encrypted data back and forth.

NBDAB

Here is how it legally is to be solved

To start there are to angles here or perceptions

a) When will you be hacked and what will they get?
b) Obfuscation - make it more difficult when or if

Tomcat: easily hackable but why and what always.. you can google this and come across 10's of great doc's which are current (from 2600 club) or 1000's which are antequaited and not applicable.

So, ask yourselve..

When I get sued for my data becoming public, what measures did I put in place to help the Attackers, or recievers of my data find usefull info.

Rule 1: Do not create a BO that includes the Name, Address, Phone and SSN - create a relation which is associated to the BO which is required to use the SSN (simple in Aware)

Rule 2: Do not store the ssn in the format which is easily human readable.
easy enough to create rules which will concantenane and help "confuse" would-be data hackers

Rule 3: SSL (to help enrcyp) and avoid onsite/remote man-in-the-middle attacks.... they go on and on..

On any event there are so many senarios in which someone who wants your data.

Make it hard for them to get to it, (This includes the users of the systems)
Make sure you are Indemnified in the event of Data Loss/Theft etc
Train the users that THEY are RESPONSIBLE if the data is shared (Click Through Agreements)

Europe or EU rules disallow the storage of personal numbers with user data. This is a country by country stipulation

USA have guidelines for Financial and other Institutions (rarely followed as you can see in the news)

Hopefully usefull,
Lars