Application Architecture

Network Level
At Network Level Security has been implemented using Firewalls and Data encryption.

Firewalls
Firewalls are often implemented at the network protocol layer and used to filter incoming network traffic. The Internet-facing firewall provides access to services such as HTTP, LDAP (Lightweight Directory Access Protocol), FTP, and SMTP mail. To make the firewall really powerful, all the ports except port 80 (for HTTP) and port 443 (for HTTPS/SSL) will be closed and block access to all IP addresses except the IP address of our Web cluster.

Data Encryption
In a business site, we are processing sensitive information such as customer credit card numbers and Social Security Numbers. Transmitting such information across the Internet without any protection can be disastrous. Anyone might listen to the transmission and gain access to confidential information. Therefore, the data must be encrypted, and transmitted over a secure channel. For implementing secure data transfer, we have used Secure Sockets Layer (SSL). When transmitting data:

• The data is encrypted.
• A secure connection is established between the source and destination servers.
• Server authentication is enabled.

Programmatic Role-based Security
With role based security we secure our components and add security-related code in our application. For this, our code checks if role-based security is enabled and the calling client is within the appropriate role. The roles that we define at the middle tier map to roles in the database. The database administrator creates the database roles that map to these application roles and assign rights to the required database elements. When it comes to securing today's multi-tier E-Business environments a strategy must be developed which takes into consideration all potential points of exposure. Those risks must be addressed point by point. Begin where all roads lead - the database.

Database Protection
We are using Microsoft SQL Server as Back End. It takes care of the security using SQL Server Authentication, Permission Validations and Encryption. It is vital that monitoring is carried out at the database level for both successful and unsuccessful access. For continuous login attempt failures, strategies for automated responses, such as disabling an ID, Notification to push security event information to those who need to know. In addition to all we have the Platform level security by hardening Server, Monitoring, securing data and client authentication.