What are the best ways to check the basic security of an e-commerce Web site?
Cobb: Firstly, you should check the security of the servers hosting the e-commerce site. A Web server needs to be hardened and securely maintained. For guidance, I recommend that you download the appropriate Security Configuration Guide from the U.S. National Security Agency Web site. The guides are free and cover most Web servers. You can also use the NIST (National Institute of Standards and Technology) Security Configuration Checklists Repository to find instructions and procedures on how to complete a secure configuration. The free Benchmark and Scoring Tools from the Center for Internet Security (CIS) also provides a quick and easy way to evaluate an e-commerce Web infrastructure and compare its level of security against minimum due-care security benchmarks. Generally speaking, an e-commerce database needs to reside on a separate server, which also should be hardened and protected. Ensure that all database connections are secured and that the database table access control list is
