- Web Security & Commerce
- Preface
- I. Introduction
- II. User Safety
- 2. The Buggy Browser: Evolution of Risk
- 3. Java and JavaScript
- 4. Downloading Machine Code with ActiveX and Plug-Ins
- 5. Privacy
- III. Digital Certificates
- 6. Digital Identification Techniques
- Ten Policy Questions
- Is legislation necessary at all?
- Where should PKI legislation occur?
- Is licensing of certification authorities the right approach?
- Should legislation endorse public key cryptography, or be “technology neutral”?
- Should legislation endorse the X.509 paradigm?
- How should liability and risk be allocated in a PKI?
- What mechanisms should be used to allocate risk?
- Should digitally signed documents be considered “writings” for all legal purposes?
- How much evidentiary weight should a digitally signed document carry?
- Should governments act as CAs?
- 7. Certification Authorities and Server Certificates
- 8. Client-Side Digital Certificates
- 9. Code Signing and Microsoft’s Authenticode
- IV. Cryptography
- 10. Cryptography Basics
- 11. Cryptography and the Web
- 12. Understanding SSL and TLS
- V. Web Server Security
- 13. Host and Site Security
- 14. Controlling Access to Your Web Server
- 15. Secure CGI/API Programming
- VI. Commerce and Society
- 16. Digital Payments
- 17. Blocking Software and Censorship Technology
- 18. Legal Issues: Civil
- 19. Legal Issues: Criminal
- VII. Appendixes
- A. Lessons from Vineyard.NET
- Planning and Preparation
- Lesson: Whenever you are pulling wires, pull more than you need.
- Lesson: Pull all your wires in a star configuration, from a central point out to each room, rather than daisy-chained from room to room. Wire both your computers and your telephone networks as stars.
- Lesson: Use centrally located punch-down blocks or 10Base-T wiring blocks for both your computer networks and your telephone networks.
- Lesson: Don’t go overboard.
- Lesson: Plan your computer room carefully: you will have to live with its location for a long time.
- IP Connectivity
- Commercial Start-Up
- Ongoing Operations
- Security Concerns
- Lesson: Don’t run programs with a history of security problems (e.g., sendmail).
- Lesson: Make frequent backups.
- Lesson: Limit logins to your servers.
- Lesson: Beware of TCP/IP spoofing.
- Lesson: Defeat packet sniffing.
- Lesson: Restrict logins.
- Lesson: Tighten up your system beyond manufacturer recommendations.
- Lesson: Eschew free software.
- Phone Configuration and Billing Problems
- Credit Cards and ACH
- Lesson: If you have the time to write it, custom software always works better than what you can get off the shelf.
- Lesson: Live credit card numbers are dangerous.
- Lesson: Encrypt sensitive information and be careful with your decryption keys.
- Lesson: Log everything, and have lots of reports.
- Lesson: Explore a variety of payment systems.
- Lesson: Make it easy for your customers to save you money.
- Monitoring Software
- Security Concerns
- Conclusion
- Planning and Preparation
- B. Creating and Installing WebServer Certificates
- C. The SSL 3.0 Protocol
- D. The PICS Specification
- E. References
- A. Lessons from Vineyard.NET
- Index
- Colophon
This part of the book introduces the basics of web security. It is intended for people who are responsible for maintaining computers connected to the Internet and for building web sites. Chapter 1 briefly describes the threats to computers placed on the Internet, how to defend against those threats, and how to control access to information stored on web servers.
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.