Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for:
- Securing Files and Folders on the server (Access Permissions).
- Database: Securing the database with password.
- Programming: Securing the shopping cart (Securing the web application).
- Data in transit: Securing the data in transit such as (user registration, payments, invoices, etc) when client sends to server, and when server sends responses to the client (forms, order history, user profile, etc)
The big question: how to ensure integrity?
- Determining Unauthorized Access that modified or tried to modify data?
- Determining Authorized Access that tried or did unauthorized actions?
- Determining whole system integrity
DB For instance, data that saved in database such as MySQL and MSSQL are not encrypted, its considered secure on the DB server, also for hug rows, encryption decreases the performance and if attacker get access DB server, he can also get the private key.
Files and Folders Lets consider that we encrypted all files that doing critical actions (such as Access Control, Data Saving, etc), now, by any way, if attacker get access to the server, he can add one line to send all ($_POST, $_SESSION, $_COOKIE, and $_GET) to an email.
Data In Transit Consider that SSL is implemented, but man-in-the-middle-attack can get a copy of traffic (this is possible). How many networks between me and stackexchange.com now? thousands! Me -> My ISP (Clients -> Core -> Border Routers -> Foreign ISP -> Foreign ISP -> Stackexchange Data Center -> Some Cluster or any other model -> Stackexchange) How can we ensure that the data between these networks not modified?
Just see this image! which currently available its not just idea:
At this point: I am asking is there any mechanism for better security for Web Applications that depends always on data in Transit? I hope to get some answers that passes me in this sadness about security :(