0

I did a search and didn't quite find an answer to my question.

I have website that is integrating with a 3rd party for eCommerce and CRM. On my side I am collecting no data. I don't collect any login data, customer data or anything. To retrieve any data I need to log in to their site.

My site pulls various forms from their server that I code into my site via one line snippets. Looking at the source code of my site I cant even see the code of their forms.

If I get an extra SSL certificate for my site via my host, BUT their site/service doesn't have a good security layer for data being transmitted does it make a difference?

Thanks

1
  • Of this 3rd party eCommerce company takes credit card transaction and doesn't have a good security (e.g. No HTTPS between the customer and the server), then you can be sure that they're violating PCI-DSS. If you have good evidence of their insecurity, you may want to find another eCommerce provider, or check out what actions you can take legally against the eCommerce company.
    – Lie Ryan
    Jul 8, 2015 at 11:50

1 Answer 1

1

This depends on how the data is being transferred.

Here's the thing: unless the attacker forces the client to use a weak cipher-suite SSL is supposedly unbreakable for something like a bazillion years. So as long as there are not unencrypted connections in this chain you're all set, regardless of how often your data is encrypted.

So that's the upside. Here's the downside: if, as you say, "their site/service doesn't have a good security layer for data being transmitted," then no, your data is not truly secure. If they don't support a strong encryption you can pretty much expect to be screwed (if someone decides to screw you, that is). Of course, it's probably in the eCommerce company's contracts to be responsible for the security of transactions, etc., so you're legally pretty safe (Although I doubt your clients will be particularly happy with you).

Like I said though, it depends on how the setup works. If this is a simple <iframe> or something similar, they're actually connecting directly to the eCommerce site, so you can't guarantee any kind of security. On the other hand you have a degree of stability if the information is routed through you, because there is an excellent defense against sniffing attacks: using wired connections. Unless someone physically penetrates your company it will be impossible for them to sniff your connection. So yeah, it doesn't matter how you transmit the information to the eCommerce company because you can be rather confident that an attacker never sees it (he can't connect to your network).

But here's the bottom line: if any sender or receiver of data in a chain of communications does not support strong encryption, the privacy of the information sent along the aforementioned chain cannot be guaranteed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .