Web Commerce Security Design and Development

What Makes a System Secure

An advanced e-commerce system is similar to a big city with a vast labyrinthine complex of neighborhoods, buildings, arched tunnels, and courtyards, divided into blocks that are dedicated to perform a predetermined function. Analyzing such a complicated system from a security point of view is not an easy task; it is similar to ensuring that the city is able to withstand attacks from its adversaries and still provide a safe place for its occupants to function and live. Your job as a system designer and implementer is to identify its weakest points, and provide adequate protection mechanisms to strengthen the protection for those weak spots, and finally ensure the system's operational integrity, much like the job of soldiers of the city in my example.

The process of making a system secure starts by identifying the factors that make an e-commerce system prone to attacks, and consequently implementing the mechanisms that counter them. As noted earlier, this requires a clear understanding of systems' security assets (the valuable items) and the attacks that they are vulnerable to. For example, an e-commerce system always requires its users to identify themselves and authenticate to it. Thus, the authentication credentials (username, password, security tokens, and the like) are almost always security assets that need to be protected. (Various protection mechanisms to augment authentication in an e-commerce system are discussed in detail in Chapter 5 and Chapter ...