IBM WebSphere V5.0 Security - CGISecurity

2.3 Security in use
Since security is a complex and diversified topic, it is important to keep it simple.
The following list will show the basic security areas. These areas have to be
taken into account and their requirements must always be fulfilled.
►
►
►
►
►
►
►
►
Authentication / Identification - Measures designed to protect against
fraudulent transmission and imitative communications by establishing the
validity of transmission, message, station or individual.
Access Control - The prevention of improper use of a resource, including the
use of a resource in an unauthorized manner.
Privacy / Confidentiality - Assurance that information is not made available
or disclosed to unauthorized individuals, entities, or processes.
Integrity - The correctness of information, of the origin of the information, and
of the functioning of the system that processes it.
Accountability / Non-repudiation - Assurance that the actions of an entity
may be traced uniquely to the entity. This ensures that there is information to
prove ownership of the transaction.
Administration / Configuration - Methods by which security policies are
incorporated into the architecture and the functionality that the system
architecture needs to support.
Assurance / Monitoring - Confidence that an entity meets its security
objectives; this is usually provided through an Intrusion Detection System.
Security Management - Assurance that an entity meets its security
management objectives, processes and procedures.
If you keep this list in mind during design and development, security will be well
implemented.
18 IBM WebSphere V5.0 Security Handbook