0

The company I work for has everything based online, ie: customer data, order information, stock etc. It's possible to log in from their website and see all of this. Moving everything is not possible. So my question is this, how can I make it more secure? At the moment, it's a standard SSL login page (username + password).

Thank You.

closed as too broad by ceejayoz, bodgit, womble Dec 21 '18 at 1:25

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

Well there are many things you can do:

  • Create IP restrictions to place(s) of work, secure those machines, if there is external access, make sure the VPN is secure.

  • Ensure the username/passwords are per person, and that actions and access are audited.

  • Standard password safety should be practiced: nothing too short, nothing dictionary, reasonably regular changes.

  • Only users that need access to data should be given it, all users should not have access to everything unless needed.

  • Timeouts on logged in users, so that they can not leave a browser authenticated for long.

  • Additional security prompts for major operations.

  • All backups should be made via secure links, if the databases are hosted remotely.

  • If hosted remotely, the hosts should have restricted access to the data preferably, unless they have good reasons for access.

  • Read data protection legislation for your region, there may be legal obligations.

Not the answer you're looking for? Browse other questions tagged or ask your own question.