This will provide the foundation for how you execute your security options. For instance, you might have a policy that states you will never send personal information about your customers, such as the name, address, phone and preferences, over an unencrypted session. Obviously, this means all credit card transactions will be conducted using a secure server. But it would also mean your registration form will be on the secure server and probably your customer service applications. Today's primary method of achieving privacy over a public network, such as the Internet, is encryption.
Authentication ensures people are who they say they are.
Nonrepudiation ensures that a person cannot deny his or her electronic actions. Such systems are known as digital receipts and are relatively new, but catching on fast, particularly in the financial industries. Physical security refers to the actual location of the hardware. All of the fancy software bells and whistles in the world won't help you if someone can simply unplug your server and put you out of business. Done right, computer security produces what is known as availability, which means that resources are ready and able when they are needed.