Security is Everyone’s Job
Today’s headlines are full of news about criminals stealing our digital data. From credit card details to healthcare records, our personal information has never been more at risk than it is today. Our clients’ – and their customers – trust us to keep their personal information private, and so we have a responsibility to ensure that our implementations are safe and secure, from inception to retirement.
The eCommerce Lifecycle
eCommerce websites live in four phases: design (including planning and analysis), implementation, operation, and retirement or refresh.
These four phases apply to the entire online store lifecycle all the way down to specific features in the website. The operation phase is the longest-lived and is also the phase in which the store is exposed to the most risk. Furthermore, security in this phase is a result of decisions made in the design and implementation phases. These choices can have a profound impact on the confidentiality, integrity, and availability of the site after it is operational.
Assumed Breach: A New Paradigm
There was a time when the “perimeter defense” was accepted as the best tactic for protecting a given asset. In the Information Security world, perimeter defense is a good firewall and perhaps some network sniffing tools thrown in for extra measure. That time has passed.
Information Security is a continuously changing landscape and tactics and strategies must change with the environment. Today, most practitioners are working from the “assumed breach” mindset; that is to say, that, instead of exclusively assigning security resources to keep the bad guys out, security resources are being assigned to detect and respond to security events in addition to securing assets throughout the platform.
In practice, this means that applications are built with security in mind: they fail in “safe” ways, report unknown conditions and data, keep auditable logs of user actions, separate data and executable files, and allow for well-defined management and upgrade processes, among other security measures.
Getting Protected
In practical terms, your eCommerce site should have a Web Application Firewall filtering out the lazy attempts to break in. You should have tools collecting and analyzing the logs being generated by your site and other metrics from your network, raising alerts for suspicious activity.
The code for the site should be written so that it can safely handle strange data that attackers may send to it. You need to have thorough testing processes for finding bugs before they get out into production. Your platform and processes should be well documented. You must know what you have and how it works before you can know if it is broken. You also need to know how to respond when things don’t go right.
As you can see, security doesn’t fall on any one area. It’s not just the hosting team, or just the developers, or just the quality assurance testers. It’s everyone.
