Data security is a critical aspect of every e-business solution. It
contains two aspects:
Security of Internal Data
The security of internal data means preventing unauthorized access to
internal company data. Imagine what could happen if competitors got a hold
of your customer accounts, accounts receivable, price lists, terms of sale
or financial information.
ATENA employs a user login to ensure data security. Users are uniquely
identified by their username and password. Authorisation for access to
specific information (e.g. product list, ordering, inventory, financials,
etc.) are a per-user setting. ATENA is an application, not just an interface
between a database and the web. Therefore users do not have direct access to
the database and cannot access areas that they are not authorised for.
 |
Never use SQL Server's sa account for
communication between ATENA and the database. |
Security of User Data
The security of user data means preventing user data (address, credit
card number, phone number, etc.) from falling into the wrong hands. When
information is transferred over the network from the user's computer to the
web server, the connection is often not secured - malware makes it possible
for thieves to intercept the traffic and gain unauthorised access to
critical data.
To prevent this, communication has to be encrypted. This is achieved with
HTTPS (Secure HTTP), a special protocol that encodes traffic with 56 or 128
bit keys. To establish an encrypted connection, the web server has to be
registered with a certification authority like VeriSign, obtain a key and
enter it into IIS.
With a key entered, access to certain areas can be encrypted.
Intrusion Prevention
If you run the web server and database server on the same computer you
should take additional measures to prevent intrusions. The web server
listens to internet connections and therefore makes the whole computer more
exposed to attacks.
Possibilities include port blocking, virtual IP addresses and others that
can be arragned by your ISP.
The optimal solution is of course having the web server and database
server run on different computers.
|
Consult with your system administrator before
setting up and running ATENA. |