Web Commerce Security Design and Development

Scalable Security

In Chapter 3, we defined scalability. There is not much point in creating a secure e-commerce system and making sure its protection and authentication mechanisms are usable, but failing to make it scale. That is, you have to ensure that while all the security aspects of the e-commerce system are maintained, it is also able to handle its expected load.

When designing for scalability, be it vertical or horizontal, your aim is to identify bottlenecks and eliminate them. This is typically accomplished by adhering to proven distributed-systems' design patterns such as eliminating single point of failure, abstracting common functionalities, enabling concurrent computing, implementing asynchronous operations, and so on. On the other hand, when designing for security, you focus on protection aspects of the security assets in relation to the attacks and the threats that they are potentially exposed to. Combining the two methodologies would produce a scalable security.

One common enemy of scalable security that I have frequently seen in the field is tight-coupling of security functionality and the business logic. For instance, authentication is a well-defined operation that demands its own subsystem, separate from the core functionality of a system (such as searching capabilities, uploading documents, and so on). However, there are unfortunately many instances of systems that intertwine the authentication logic with the core business logic. Designing and implementing any ...