Security in banking application

Question

Hi expert Recently i was asked in interview what are the security you have given to your banking application. I couldn't answered it properly. Could somebody tell me what are the possible security can be given to online banking application. And how can i achieve it??? pls help me with example. Thanks India

Niradhip Chakraborty · Answer

You don't have to encrypt from web.config. You can write a logic and encrypt the sensitive data before saving to database. Just for example here is the code for encryption and decryption: // encryption public string EncryptString( string strInput) { int i = 0; string strTemp = null ; for (i = 0; i { int charValue = Convert .ToInt32(strInput[i]); // converting in ascii charValue ^= 30; strTemp += char .ConvertFromUtf32(charValue); } return strTemp; } //decryption public string DecryptString( string strInput) { int i = 0; string strTemp = null ; for (i = 0; i { int charValue = Convert .ToInt32(strInput[i]); // converting in ascii charValue ^= 30; strTemp += char .ConvertFromUtf32(charValue); } return strTemp; } You also can use your own logic for encryption and decryption.

ADRIAN NGABO · Answer

Dear my friend I hope all is well for you. I'm called Ngabo Adrian. I'm in Uganda. I designed a software called Banking Management Solution. I used VB.Net Ms Access and VS 2010 Professional. You can try my software for free. Just download it from my blog: http://bankingmanagementsolution.blogspot.com/ I can sell the code to you if you need and have the money. You can contact me on my e-mail: adrian.ngabo@gmail.com Thank you Ngabo Adrian

Eamonn · Answer

That's not encryption it's encoding and provides no effective protection to your data it could be cracked in minutes (if it even took that long). You should never use your own logic for encryption use proven industry standard algorithms. Sensitive financial data should be encrypted using AES or an equivalently strong algorithm with a strong crypto-randomly generated key and proper key management used to secure the encryption key. For payments systems the Payment Card Industry PA-DSS standards or equivalent for your region should be applied. You should also familiarise yourself with FIPS .

India Programmer · Answer

Now i want to how to encrypt the the data from web.config file. Pls help..

Niradhip Chakraborty · Answer

You need to get a Certificate for your web site. Depending on the certificate type this can be a lengthy process. You should program your site so that any http accesss gets redirected to https upon setting of a flag in the web.config. Regarding restriction on location you should do one or both of the following: Restrict IIS to respond only to the IP address of the outgoing traffic from each office. Restrict by account the IP address(s) it can be used from. As this is purely administrative and does not require altering IIS it is preferable. It also has the benefit of making an account for client A being usable at client B. You should rigorously unit test all your code. Use only stored procedures and filter ALL user input. The certificate can be obtained from verisign or godaddy .com. Along with that if you are handling online payment make sure reversal and voiding of payment is properly handled. If you are storing any sensitive data's of user in database make sure it is properly encrypted.