- Web Security & Commerce
- Preface
- I. Introduction
- II. User Safety
- 2. The Buggy Browser: Evolution of Risk
- 3. Java and JavaScript
- 4. Downloading Machine Code with ActiveX and Plug-Ins
- 5. Privacy
- III. Digital Certificates
- 6. Digital Identification Techniques
- Ten Policy Questions
- Is legislation necessary at all?
- Where should PKI legislation occur?
- Is licensing of certification authorities the right approach?
- Should legislation endorse public key cryptography, or be “technology neutral”?
- Should legislation endorse the X.509 paradigm?
- How should liability and risk be allocated in a PKI?
- What mechanisms should be used to allocate risk?
- Should digitally signed documents be considered “writings” for all legal purposes?
- How much evidentiary weight should a digitally signed document carry?
- Should governments act as CAs?
- 7. Certification Authorities and Server Certificates
- 8. Client-Side Digital Certificates
- 9. Code Signing and Microsoft’s Authenticode
- IV. Cryptography
- 10. Cryptography Basics
- 11. Cryptography and the Web
- 12. Understanding SSL and TLS
- V. Web Server Security
- 13. Host and Site Security
- 14. Controlling Access to Your Web Server
- 15. Secure CGI/API Programming
- VI. Commerce and Society
- 16. Digital Payments
- 17. Blocking Software and Censorship Technology
- 18. Legal Issues: Civil
- 19. Legal Issues: Criminal
- VII. Appendixes
- A. Lessons from Vineyard.NET
- Planning and Preparation
- Lesson: Whenever you are pulling wires, pull more than you need.
- Lesson: Pull all your wires in a star configuration, from a central point out to each room, rather than daisy-chained from room to room. Wire both your computers and your telephone networks as stars.
- Lesson: Use centrally located punch-down blocks or 10Base-T wiring blocks for both your computer networks and your telephone networks.
- Lesson: Don’t go overboard.
- Lesson: Plan your computer room carefully: you will have to live with its location for a long time.
- IP Connectivity
- Commercial Start-Up
- Ongoing Operations
- Security Concerns
- Lesson: Don’t run programs with a history of security problems (e.g., sendmail).
- Lesson: Make frequent backups.
- Lesson: Limit logins to your servers.
- Lesson: Beware of TCP/IP spoofing.
- Lesson: Defeat packet sniffing.
- Lesson: Restrict logins.
- Lesson: Tighten up your system beyond manufacturer recommendations.
- Lesson: Eschew free software.
- Phone Configuration and Billing Problems
- Credit Cards and ACH
- Lesson: If you have the time to write it, custom software always works better than what you can get off the shelf.
- Lesson: Live credit card numbers are dangerous.
- Lesson: Encrypt sensitive information and be careful with your decryption keys.
- Lesson: Log everything, and have lots of reports.
- Lesson: Explore a variety of payment systems.
- Lesson: Make it easy for your customers to save you money.
- Monitoring Software
- Security Concerns
- Conclusion
- Planning and Preparation
- B. Creating and Installing WebServer Certificates
- C. The SSL 3.0 Protocol
- D. The PICS Specification
- E. References
- A. Lessons from Vineyard.NET
- Index
- Colophon
This part of the book discusses strategies for securing Internet servers. Although these chapters are heavily oriented towards the administrators or programmers of those servers (UNIX, Windows NT, or Macintosh), other readers should also find these chapters interesting and useful.
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.