Re: Security for web site accessing i via IWS -- WEB400

Just a couple quick points. It sounds like your interface would be more
streamlined if both your web site and your web service were running on the
same server, and that security would be easier to establish and maintain
thereby. You might also consider how to expire your sessions, and what to
do after that.

On Mon, Feb 2, 2015 at 10:20 AM, Koester, Michael <mkoester@xxxxxxxxxxxxx>
wrote:

Seeking advice on security to and from a web site and the IBM i database...
I'm developing the back-end web services to support a redesign by a
business partner of a website used for Bill Presentation and Payment.
Customers' account details, including payment account info, are to be
inputs to the web service, and obviously need to be secured as they
traverse the communications links. I need to know that what I'm doing is
sufficient -- at least that I've made what is a reasonable effort to
protect customer data.

My web services use the IBM Integrated Web Services (IWS), calling i 7.1
RPG programs to retrieve and update our i database, and staging committed
payment data for ACH transactions. PTF's for HTTP and IWS are current.

Here are the elements of my design:
1) The web site will be accessible to the user via SSL. This will be the
responsibility of the web site developer.
2) All traffic to and from the IWS operations will use SSL, with a
self-signed certificate provided by our SysAdmin to the web site developer.
3) The web site developer is responsible for user authentication prior to
calling the web service operations.
4) When a user is authenticated, the web site script makes a call using
SSL to a web service operation to retrieve the details of the customer
account.
5) My RPG program that retrieves the account details generates a 10-digit
"SessionID" which is returned with the account data to the web site.
6) Calls to subsequent operations (PostSettingschange and PostPayment) by
the web site must include that SessionID, which I use to log the session
activity to a log file, and to track what data has been sent to the web
site.

I'm sure that there are no absolute guarantees of security, and that there
may be a myriad of expensive add-ons to make the process incrementally
"more secure", but have I missed something that would make my plan
irresponsibly inadequate? Are there things about SSL that I need to check
to ensure that SSL flaws exposed last summer have been remedied? What are
other shops doing to handle these concerns?

Many thanks.
Michael Koester
Programmer/Analyst
DataEast

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.