Website hosting (confidential data)

[Billy Pilgrim]

A friend has asked me whether I can knock together a database (web fronted) to store names/addresses/phone numbers etc.

I'm a bit concerned about the data security aspect though. Would it be suffiecient to use my existing ISP / Domain host ... make sure that the site is secure (SSL) and password protect user access OR are there guidelimes that MUST be followed when dealing with this type of data?

Any comments / help / links appreciated !!

[DaveB]

You're going to bump up against Data Protection legislation with this one. There are very strict rules on how and why you can store this kind of information.

Start here for the basics - Information Commissioners Office.

You dont just need to worry about SSL and passwords you need to worry about building a secure database and web interface that can stand up to any attempts to compromise it by a third party.

Without going into details, there are people on here far more qualified than me to do that, you need to be thinking about ensuring that unused services on the hosting server are disabled, that your web code is secure and not able to be exploited by known security loopholes ( cross site scripting, SQL injecttion etc ), that the data your underlying database is secure and that you properly authorise access to the site and database. This is just for starters.


Getting it wrong and losing sensitive personal data can land you in a lot of trouble so you need to be sure you get it right.

[Billy Pilgrim]

You're going to bump up against Data Protection legislation with this one. There are very strict rules on how and why you can store this kind of information.

Start here for the basics - Information Commissioners Office.

You dont just need to worry about SSL and passwords you need to worry about building a secure database and web interface that can stand up to any attempts to compromise it by a third party.

Without going into details, there are people on here far more qualified than me to do that, you need to be thinking about ensuring that unused services on the hosting server are disabled, that your web code is secure and not able to be exploited by known security loopholes ( cross site scripting, SQL injecttion etc ), that the data your underlying database is secure and that you properly authorise access to the site and database. This is just for starters.


Getting it wrong and losing sensitive personal data can land you in a lot of trouble so you need to be sure you get it right.

Cheers Dave - interesting reading