Hello!
Okey, here's the thing. My self and a couple of study mates are writing an theoretical report about what security issues to think about when building and launching a web shop on a server at the small company. The (fiction) web shop is not a purchased solution, it's coded by the companies web developer in ASP.NET C# with a mdf_database for example.
What i need is some hints and tips on what major things to think about.
So far we have covered:
1. How to safely store user data in the database (hash algorithms within the machinekey)
2. Setting up the network in DMZ
3. Certificates and key management
4. How the customer will pay safely (payment gateway, eg. PayPal)
5. Hardware/software firewalls
That's about it, and now we're stuck, atleast i am.
Anyone have some extra subjects to cover? Maybe if we presuppose that CIAA (Confidentiality, Integrity, Availability, Auditability) needs to be involved.
Go to the complete details ...