World-Wide Web Security

Isolated file systems (firewall)

Server protection mechanisms --

(1) Secure Web Server Protocols

S-HTTP: Secure-HTTP

One of first security protocols

Developed by Enterprise Integration Technologies (EIT) which formed Terisa Systems in conjunction with RSA Data

S-HTTP is security-enhanced extension of Hypertext Transfer Protocol

Encrypts contents of messages relayed between browser and server using RSA's public/private key algorithm (invented by Rivest, Shamir, Adleman)

SSL: Netscape's Secure Socket Layer

PCT: Microsoft's Private Communication Technology

PCT and SSL similar in many ways

SET: Visa and MasterCard's Secure Electronic Transactions

Visa formed alliance with Microsoft and proposed Secure Transaction Technology (STT)

MasterCard and Netscape offered Secure Electronic Payment Process (SEPP) proposal

All four parties agreed on converged protocol (SET) specifically designed for credit-card transactions

(2) Passwords --
must be combination of letters, numbers, and special characters;
must not be in any dictionary;
change often

(3) IP address restrictions --
local web, "Intranet"