Introduction

What would a book about "hack proofing" your own e-commerce site be without a section on hacking? This chapter explains what types of attacks you can expect against your site and how to simulate them to test the security on your own.

Although there is no such thing as a totally secure system, performing your own evaluation will probably bring your site much closer to your expectations. Many times, in the rush and excitement of building a new site, a few steps or pieces get missed along the way. These accidental omissions may open the door to an attacker down the road, so if they are found early by your team you can avoid having them be used against you.

What can you expect from testing your security? You can expect that your team will find some holes. You can expect that they will be fixed. You can expect that more will be found, and that the cycle will continue forever. You can also expect that after your site is open to the public, other people will test it for you. That's the whole purpose of this chapter: to put you one step ahead.

Anticipating Various Types of Attacks

In order to begin planning an attack against your site, you should know what the various types of attack are, and how they work. Any attack will attempt to subvert some combination of confidentiality, integrity, and availability, as outlined in Chapter 2. It's your job to maintain confidentiality, integrity, and...