This was a presentation I gave highlighting the security infrastructure at SUA

1. Shape Up and Drop 10
Security Overview
Alex Colcord
SUA Online Services

2. System Requirements
 Secure access
 Secure transactions
 Secure member data

3. Vulnerabilities
 At the web server
 At the data access tier
 During transaction processing

4. Web server hazards
 TCP/IP data channel
– SSL 3.0 encryption
 Username/password tokens
– Secure cookie storage
 IIS security flaws
– Service upgrades

5. Web server hazards
 TCP/IP data channel
– SSL 3.0 encryption
 Username/password tokens
– Secure cookie storage
 IIS security flaws
– Service upgrades

6. Web server hazards
 TCP/IP data channel
– SSL 3.0 encryption
 Username/password tokens
– Secure cookie storage
 IIS security flaws
– Service upgrades

7. Web server hazards
 TCP/IP data channel
– SSL 3.0 encryption
 Username/password tokens
– Secure cookie storage
 IIS security flaws
– Service upgrades

8. Web server hazards
 TCP/IP data channel
– SSL 3.0 encryption
 Username/password tokens
– Secure cookie storage
 IIS security flaws
– Service upgrades

9. Web server hazards
 TCP/IP data channel
– SSL 3.0 encryption
 Username/password tokens
– Secure cookie storage
 IIS security flaws
– Service upgrades

10. Data Access Hazards
 Password database
– Firewall security/sequestration
 User data database
– Firewall security
 Credit card database
– Firewall security/auto-deletion

11. Data Access Hazards
 Password database
– Firewall security/sequestration
 User data database
– Firewall security
 Credit card database
– Firewall security/auto-deletion

12. Data Access Hazards
 Password database
– Firewall security/sequestration
 User data database
– Firewall security
 Credit card database
– Firewall security/auto-deletion

13. Data Access Hazards
 Password database
– Firewall security/sequestration
 User data database
– Firewall security
 Credit card database
– Firewall security/auto-deletion

14. Data Access Hazards
 Password database
– Firewall security/sequestration
 User data database
– Firewall security
 Credit card database
– Firewall security/auto-deletion

15. Transaction Hazards
 Client - server channel
– SSL 3.0 encryption
 Server - OPS channel
– Triple DES encryption
 OPS - card processor
– Extranet financial network

16. Transaction Hazards
 Client - server channel
– SSL 3.0 encryption
 Server - OPS channel
– Triple DES encryption
 OPS - card processor
– Extranet financial network

17. Transaction Hazards
 Client - server channel
– SSL 3.0 encryption
 Server - OPS channel
– Triple DES encryption
 OPS - card processor
– Extranet financial network

18. Non-System Errors
 Logon errors
– Password loss or theft
 Client misconfiguration
– SSL or cookies disabled
 Invalid credit card submission
– Invalid, expired, or stolen cards
 Network/Client failure
– Timeout and rollback capabilities

19. Security Goals
 Develop transparent security layer
 Safeguard user information
 Create reassuring environment