Such protection requires an on-going investment in infrastructure, process, and organization. No confidential data shall be stored on the Web Server. It is assumed that in the course of doing business, the Web server is vulnerable to attacks from hackers and competition. All confidential data shall reside inside the corporate firewall. Only secure sessions with the clients shall be allowed.
Secure sessions require password validation and data encryption.
A session with a client is no longer secure if left unattended. All sessions will be timed out automatically. User authentication should be a must for accessing the system. A password creation and maintenance policy must be developed before the system goes into production. All passwords must comply with the established security policies.