We are trying to improve security on our outside ASPX application. I have some mandates and questions from our security officer. Please help me evaluate:
We set our web server to require HTTPS only on the web app directory
We are going to buy an SSL certificate and install in on the web server
All of our data is stored in MS SQL Server database
We will NOT be collecting privacy sensitive information such as Driver's License Numbers or Social Security Numbers
We will require CustomerID and a Password for access to the application
What other additional steps should we require?
Store customer password in an encrypted field on the SQL Server?
Compile every SQL Stored Procedure with Encryption?
Thanks for your opinions.
...
Go to the complete details ...