Each category can be further broken down into additional subcategories. The Web server software and other applications run in restricted environments to prevent an attacker from leveraging software flaws to gain privileged access to the operating system or critical services. There is no mobile code, lessening the risk to both servers and users. The application server controls access by specific users and groups to specific content through a Security Manager component. Users authenticate with user IDs and passwords, while system administrators are required to use strong authentication.
Firewalls restrict access at the network layer.
Requiring SSL connections between the Web browser and the Web server ensures confidentiality of data passed between users and the portal. Auditing and monitoring. Log data is captured and stored on a secure host for processing and retrieval. Use of an intrusion-detection system complements logging. Backup and recovery.