Web Commerce Security Design and Development

Isolation

In addition to implementing security controls, isolation is another option for improving the security posture of computer systems involved in Web commerce. In general terms, isolation involves dividing a system into compartments that are segregated from each other such that a compromise in one area does not propagate to another. Isolation can be implemented by separating process address spaces, memory areas, and running programs (sandboxes).

Some of the important issues that have to be addressed in implementing isolation are determining the partitions, setting access permissions for each partition, and allocating bounded memory space for each partition. Three methods that support these isolation requirements are virtualization, the sandbox, and IPSec.

Virtualization

Virtualization employs the concept of a virtual machine running on a physical computing platform. Virtualization is controlled by a Virtual Machine Monitor (VMM) or hypervisor, such as Xen, which is an open source hypervisor. Virtual machines emulate a complete host computer, on which a conventional operating system may boot and run as on actual hardware. The guest operating system is isolated in the sense that it does not run natively on the host and can only access host resources through the emulator. Therefore, physical computing resources are logically partitioned into multiple execution environments, including operating systems, servers, and applications.

Virtualization offers a means to consolidate applications ...