Re: [Phpgroupware-users] Re: Security provisions of CK-ERP

[C K Wu]

Hi, Dave,

I thought you are fully occupied with giving Noah his first programming 
lesson  :) .

Dave Hall wrote:

> On Fri, 2005-01-21 at 12:48 +0800, C K Wu wrote:
>  
>
> > Hello, folks,
> >
> > I noticed the Jan 14 irclog of #phpgroupware carried a query on the 
> > security of CK-ERP.
> >    
>
> <snip />
>
>  
>
> > However, internet is inherently a hostile place.  If, CK-ERP, as a web 
> > application, is placed on the web for access by users anytime, anyplace, 
> > then, VPN or some encrypted tunnelling access is advised.
> >    
>
> HTTPS should be adequate for encryption, even for LAN access it is
> advisable, to you trust all of your users? Access to the server is a
> separate issue :)
>
>  
Well, most auditor will insist that no user should be trusted beyond the 
absolute bare minimum :( .  Because the system now includes some rather 
sensitive staff and financial information being made available online, 
security does become a basic system requirement.  Actually, I would 
imagine, in some juridiction, legal requirement in terms of data privacy 
protection may come into play.

Cheers,
CK

> Cheers
>
> Dave
>