14.1.2 Securing application services on public networks

Information involved in application services passing over public networks should be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification.

Information security considerations for application services passing over public networks should include the following:

a) the level of confidence each party requires in each other’s claimed identity, e.g. through authentication;

b) authorization processes associated with who may approve contents of, issue or sign key transactional documents;

c) ensuring that communicating partners are fully informed of their authorizations for provision or use of the service;

d) determining and meeting requirements for confidentiality, integrity, proof of dispatch and receipt of key documents and the non-repudiation of contracts, e.g. associated with tendering and contract processes;

e) the level of trust required in the integrity of key documents;

f) the protection requirements of any confidential information;

g) the confidentiality and integrity of any order transactions, payment information, delivery address details and confirmation of receipts;

h) the degree of verification appropriate to verify payment information supplied by a customer;

i) selecting the most appropriate settlement form of payment to guard against fraud;

j) the level of protection required to maintain the confidentiality and integrity of order information;

k) avoidance of loss or duplication of transaction information;

l) liability associated with any fraudulent transactions;

m) insurance requirements.

Many of the above considerations can be addressed by the application of cryptographic controls (see Clause 10), taking into account compliance with legal requirements (see Clause 18, especially see 18.1.5 for cryptography legislation).