Computer Security Handbook, Fifth Edition

CHAPTER 30

E-COMMERCE AND WEB SERVER SAFEGUARDS

Robert Gezelter

30.1 INTRODUCTION

30.2 BUSINESS POLICIES AND STRATEGIES

30.2.1 Step 1: Define Information Security Concerns Specific to the Application

30.2.2 Step 2: Develop Security Service Options

30.2.3 Step 3: Select Security Service Options Based on Requirements

30.2.4 Step 4: Ensures the Ongoing Attention to Changes in Technologies and Requirements

30.2.5 Using the Security Services Framework

30.2.6 Framework Conclusion

30.3 RULES OF ENGAGEMENT

30.3.1 Web Site–Specific Measures

30.3.2 Defining Attacks

30.3.3 Defining Protection

30.3.4 Maintaining Privacy

30.3.5 Working with Law Enforcement

30.3.6 Accepting Losses

30.3.7 Avoiding Overreaction

30.3.8 Appropriate Responses to Attacks

30.3.9 Counter-Battery

30.3.10 Hold Harmless

30.4 RISK ANALYSIS

30.4.1 Business Loss

30.4.2 PR Image

30.4.3 Loss of Customers/Business

30.4.4 Interruptions

30.4.5 Proactive versus Reactive Threats

30.4.6 Threat and Hazard Assessment

30.5 OPERATIONAL REQUIREMENTS

30.5.1 Ubiquitous Internet Protocol Networking

30.5.2 Internal Partitions

30.5.3 Critical Availability

30.5.4 Accessibility

30.5.5 Applications Design

30.5.6 Provisioning

30.5.7 Restrictions

30.5.8 Multiple Security Domains

30.5.9 What Needs to Be Exposed?

30.5.10 Access Controls

30.5.11 Site Maintenance

30.5.12 Maintaining Site Integrity

30.6 TECHNICAL ISSUES

30.6.1 Inside/Outside

30.6.2 Hidden Subnets

30.6.3 What Need Be Exposed?

30.6.4 Multiple Security Domains

30.6.5 Compartmentalization ...