We will discuss both forms of commerce, because both are very important. .
What are clients concerned about?.
What do we want to sell?.
Security: Securing data requires attention to all parts of the system. A weak link in the chain can provide a opening for a security breach. It is important to consider the security of your operating system, file system, hardware (both server and client), data field encryption, web server, application, browser:.
Some of the risks include:.
For both client and server: .
eavesdropping, fraud.
For the end user: .
active content, privacy infringement.
For the web site: .
webjacking, server and LAN break-ins, denial-of-service attacks.
Doing a security review: Corporate-wide privacy and confidentiality policies are important. Management must provide sufficient resources to get the job done and back security policies and procedures. Applications must be reviewed for appropriate level of security, responsibilities and authority must be clear, and a direction must be chosen. It is not necessary that the policies used be perfect, but it is necessary that they be well understood and fully implemented. .
At Ford, we have developed a number of procedures for making sure our data is secure. One of the most important is called an ACR, or Application Control Review. The data owner must go through a process of deciding how critical, and how confidential his data is, based on easily understood and well-defined terms, like whether it is financial or private, and whether it is confidential or secret. Then he knows exactly what other reviews he needs to do and what controls he needs to put into place for that data. for instance, financial data or password data obviously needs to be encrypted. There are checklists for each kind of application, and it is easy to see whether the required work has been done or not. .
Choosing a platform: Our areas of experience cover the gamut, from IBM AS/400 and Sun servers, through Linux to Microsoft and Apple Macintosh platforms.