I have been developing a system and the client has posed the following points for me to respond to. I understand them on the whole, but would ask an expert to elaborate the various points for me before i respond. Or suggest anything else to include in the response.
Point 1) prevention of access to unauthorised users and denial of service attacks.
My comments: Users access the web system via a user name and password, users can not access without these credentials. What is referred to by "service attacks"? The web system is the service, and access is restricted to authenticated users.
Point 2) Database protection
My comments: What is mean't by database protection? Code has been written to avoid SQL hacks. The database must also be accessed with authentication details. What else should be considered protective measures for database protection??
Q3) Active X and Java applets
My comments: The system doesn't use java applets, so no cause of concerns with security there. Nor does it use Active X.
Q4) Web server security and CGI scripts
My comments: "Web server security" seems quite broad. Can someone list reasonable measures for "web server security" so that i can be sure i'm taken them, and respond accordingly. Regarding CGI scripts, i *don't* think my site uses them.
Q5) Confidentiality of information submitted across the web prevention of information interception from browser to server.
My comments: Now i would appreciate any security experts to comment here, since i have not consciously taken any measures here, and was not aware of what measures can be taken. Can someone make some comments regarding this last point or point me in the right direction for finding more?
Many thanks :)
Start Free Trial
