Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

I'm designing a web application. I need to make sure all my customer's SSN data is secure. Now I know HTTPS with SSL, I'm wondering what are its weaknesses? What else I need to provide a perfectly secure web interface? I'm going to host the server via Amazon EC2 or some other cloud service.

share|improve this question
1  
Does the web application need the SSN? If possible try using an alternate identifier, encrypt and secure your database, and rigorously test and log your application for exploits. – dr jimbob Feb 2 '12 at 20:48

1 Answer

up vote 3 down vote

HTTPS is only one part of the puzzle - securing the link between webserver and customer's laptop - and to be honest, it is the simplest bit, as web servers and browsers pretty much do this right, however you will need to enforce SSL v3 and approved algorithms.

In addition you will need at a minimum:

  • authentication to your web application for customers (username/password, token)
  • session management
  • validation of input (see questions on SQLi and input validation)
  • protection of your database (possibly encryption)
  • controls defined for developers, admins and others who have access
  • an assessment of resilience - if your customer cannot connect to the EC2 instance, they are DoS'ed
share|improve this answer
To help the mindset, think data at rest, data in storage, and data in transit. You mentioned ssl (data in transit). Rory added encryption (et al.) which can help with all three. – Jeff Feb 3 '12 at 18:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.