Author's note: This page was originally developed for the Interpath Web Development Group Any information outside of this page is not the opinion of Interpath or its subdivisions.

Security on the Internet has many facets which include:

There is a very comprehensive WWW FAQ available at MIT that details security relating to Server Protection. It discusses possible security problems with CGI, Protected Directories, Server-Side Includes, SSL, Java, ActiveX, etc. from the point of view of a person installing a Web Server. Anyone talking to customers about the WWW should read that FAQ in its entirety to be intelligently informed about Server Security.

If you want to hear specifically about ActiveX vs. Java security, a frank discussion called "Why ActiveX is Evil" is available online.

The main cause for concern among Internet users is: Credit-card security. This involves two processes.

  1. 1: The path from Browser to Server and back. The best (and unbreakable if done correctly) method for this is for the Client and the Server to speak SSL.
  1. 2: The path from Server to Company. OK, so the data was securely transmitted back and forth from the Browser to the Server, now what? The data still has to somehow get from the Server to the Company. This is much more risky and is often part of the transaction that the User is unaware of. What do most people do? Amazingly, they e-mail it. E-mail is insecure by nature but is very convienient. Saving the information to a file on the Server to be picked up later is probably a better idea, but how do you get it off the server without sending it through the Network? You can't. At that point you could try some form of encryption or at least compression when removing the data from the Server. There are alternatives. One creative one I noticed the other day was this: Send part of the CC# in one e-mail message, then the last 4 digits moments later. Then at least it's not all in one e-mail message. Common sense should tell you to not put the words "Credit Card" or even "Order" in your e-mail messages to avoid appearing too obvious.

Point being that SSL in all its official grandeur makes the User feel protected even though it only protects Browser to Server transactions.

As far as Machine Security is concerned you basically are at the mercy of the System Administrators for your Server. Although a machine break-in is not directly related to the WWW it can mess up your data just as quickly. The same goes for Machine Failure.

To my knowledge, security violations are rare on the Internet. They're much like computer Virii: A lot of hype, not many occurences. People speak of not wanting to submit their credit-card over the 'Net but they willfully give it to a human to carry away at the Steakhouse.

-Jesse Ferrell