Chapter 17: Implementing E-Commerce Enterprise Application Security Integration

“There are no such things as applied sciences, only applications of science.”

—Louis Pasteur (1822–1895)

Mergers, acquisitions, and multicompany collaborative federations are nothing new to the e-commerce world. What is new and urgent is the need to secure a high number of critical applications from unauthorized use, both from external and internal sources. Today’s e-commerce characteristics, including remote workforces, wireless applications^[1], corporate partnership programs, CRM systems, and numerous others require organizations to increase the availability of corporate information, which significantly increases security risks.

The Challenge

Enterprise Application Integration (EAI) solves or simplifies many of the problems of data access and resource management across the enterprise, but then, a whole new set of issues surface. Once you have integrated your applications and business processes into a single, virtual “business engine,” how do you control access to those applications and processes, and the data that they manage?

In the past, companies maintained security by allowing only trusted insiders to access sensitive corporate applications and data, through physically restricted access. However the rise of e-commerce now requires those companies to allow their customers, prospects, suppliers, and partners to access even the deepest reaches of the corporate “backend.” IT management has been put on the horns of a dilemma: access versus barriers. If they tighten security to eliminate the risk of electronic theft or vandalism, the business grinds to a halt.

This is the central issue of enterprise security. How can an organization provide access to multiple users or groups without compromising data security? This issue is further complicated by e-commerce as the next step in the evolution of global companies. By distributing applications and data across the Internet, institutions face a whole new set of problems and threats controlling access to—and protecting the integrity of—data and business processes.

^[1]Vacca, John R., Wireless Data Demystified, McGraw-Hill Professional, 2003.