Forum Moderators: coopster

Message Too Old, No Replies

Securing client data on a website

security

         

kateb

2:48 pm on Jun 29, 2010 (gmt 0)

10+ Year Member



I am building a website where the client (an accountant) wants their clients to be able to upload and download financial documents (tax returns etc) from a dedicated client area (secured by a username and password). I will probably be using an off-the-shelf php/mySQL CMS such as CMS Made Simple or modX so the client can administer the site and their client areas.

In terms of transferring the files and sensitive information I can install an SSL certificate, but how do I ensure the information stored on each client page remains secure and no one manages to hack in and steal their information? Are their particular security measures I can take, or should storing sensitive data on a website (in a mySQL database to be exact) be avoided at all costs?

Sorry if this is a noob question, most of my clients have no need for super-secure areas on their site, so I am not particularly experienced in this area.

Thanks in advance for any advice :)

rocknbil

5:17 pm on Jun 29, 2010 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Welcome aboard kateb, there's no "easy" answer. The first place to look is to read up on the security measures in respect to storing credit card information and PCI compliance. Although it's specific to CC info, this will give you an idea of the gravity and liabilities your client is in for.

how do I ensure the information stored on each client page remains secure and no one manages to hack in and steal their information?


The only honest answer: you don't. Anything can be hacked. You can decrease the odds by having a dedicated server in a location under your control (i.e., shared or commercial hosting is out of the question) and there are limited services that offer certified security of their servers. And it's expensive.

There are so many aspects to this it's not just your scripts, it's the security of the server it's on, the network on which it resides, the physical security of the device, the security of all those accessing it . . it goes on. Additionally if you're in the U.S., the new Red Flags ruling is going to make things even more dicey, everyone seems to be ignoring it right now but it's a reality.

Now, I know of clients who are, to this day, accepting sensitive information via email, storing credit card info on their servers, and have done so for years, claiming "I've never had a problem." Good for them, but it only takes one mistake and they will be in a very big pile of trouble. You can drive for 20 years withou car insurance until you injure someone . . . then everything changes.

Start by looking at the policies for credit cards, this.

kateb

12:55 pm on Jun 30, 2010 (gmt 0)

10+ Year Member



thx for the great info rocknbil. Yes, I think you're right - this is a website feature we're going to steer well clear of. Just not worth the headache!