Best Practices for E-Commerce customers?

[scantwell]

Quick question..

What experience does anyone in the forum has with setting up a PA in an E-Commerce site?

Is there anything in specifics that we need to do differently than a normal implementation?

The basis is that E-Commerce will have servers on the internet, so they are very prone to "nosey" people who are constantly trying to exploit vulnerabilities.

I understand that we scan for the known vulnerabilities, but I also need to know if there is anything else that needs to be done on the FW.

I am going to recommend that SSL Inbound Decryption be enabled to give the FW the opportunity to scan for the bad traffic.

Any other items/best practices, configuration recommendations, etc, would be greatly appreciated.

Let me know asap  :smileysilly:

Steve

[Satish]

Hi Scantwell,

I hope you are doing well, As well as my point of view you should also  consider Zone protection, DDOS attack protection.

Regards

Satish

[mivaldi]

If they hold credit card data they may want to follow the PCI DSS recommendations

https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

Also make sure to use the Data Filtering options to avoid credit card numbers be stolen from their network.

Check this out:

How to Test Credit Card Number Blocking with Data Filtering