And yet, for all the earnest advice available, there is little down to earth, practical guidance on what e-commerce security should really be about. Here we provide some insights into the realities of e-commerce security and try to sort out myth from practical reality. Let us help answer some of the basic, simple questions security professionals take for granted - and assume you know. The media accurately reports security weaknesses and risks Credit card information is unsafe on the Internet Passwords authenticate people Once configured and installed, a security solution remains secure Firewalls are impermeable. Only you know the right balance between cost and risk reduction.
Security is just another part of risk management.
Information security is a blend of common sense, business risk management and basic technical skills tempered by good management, sensible use of specialist products, options and expertise and sound development practices. The website is just the means of delivery. Reality - All too often security is more about proper development process control, strong configuration management of the operational system and general disciplined website management. The real security issues are under your direct control - what might be acceptable practice for internal systems development may be inadequate for services exposed to full public access. System failures that, internally, affected only a few trusted employees suddenly become apparent to the world at large.