I'm designing a web application. I need to make sure all my customer's SSN data is secure. Now I know HTTPS with SSL, I'm wondering what are its weaknesses? What else I need to provide a perfectly secure web interface? I'm going to host the server via Amazon EC2 or some other cloud service.
HTTPS is only one part of the puzzle - securing the link between webserver and customer's laptop - and to be honest, it is the simplest bit, as web servers and browsers pretty much do this right, however you will need to enforce SSL v3 and approved algorithms.
In addition you will need at a minimum:
- authentication to your web application for customers (username/password, token)
- session management
- validation of input (see questions on SQLi and input validation)
- protection of your database (possibly encryption)
- controls defined for developers, admins and others who have access
- an assessment of resilience - if your customer cannot connect to the EC2 instance, they are DoS'ed