Requirements:
- Online application in a secured channel.
- Uploaded application and attached document needs to be secured.
- Collect Facebook authentication token.
- Access to submitted application from our internal staff in secure way.
- The current website was design and created by a website design house. Mainly static contents.
- We have an internal system which stores all client's sensitive information.
- We have register company domain and website is hosting on a shared hosting plan. i.e. Many other outside domains are hosted together, sharing resources and IP. This was fine at the moment since we only serves static information on our website.
- Website contents is managed by Modx.
- Design house will be responsible for creating new application form on our website.
- We will setup the environment for new website deployment and make sure the security of application data.
- Since our online application need to be secured, we needs https on application pages.
- Internal system should be separated from website for security concerns.
- Application data will be stored on hosting server database and file system.
- The application data on website should only be a temporary storage. Once it's retrieved from our staff, it should be cleanup from website database.
- Application data should not be accessible by Design house personnel. We should only provide minimal access for their deployment. Once done, we should restrict their access.
- Access to application data on website should be granted only to IPs from office and internal system servers.
- Move web hosting to VPS so as to get a dedicated IP and server resource.
- Setup VPS and grant required access to design house for their deployment.
- Create access point on getting the Facebook authentication token and applications into our internal system.
- The original communication between us and design house was handle by another colleague who didn't say anything about online application security concerns. No HTTPS was plan in the implementation.
- Raise security concern to product director.
- Agreed on we should make all application form secured. Using HTTPS and SSL connections.
- Secure points: submission of form; Storage of application data on web server; Secure retrieval of data from web server to our internal system.
- Coordinate with design house to make sure we are on the same picture and they know what they're going to do.
- Coordinate with developer on the way to get access Facebook token that will be stored on web site database.
- Apply VPS hosting plan. Pay the bill, get access to VPS.
- Setup VPS for Modx deploy.
- ....
