Since the implementation will use a Web Server connected to the Internet, security is a concern. This concern stems from two sources: how to prevent a “man in the middle attack” whereby a third party will intercept transmissions to and from the application and learn about a user’s password or other personal information, and how to ensure that an individual interacting with the system is entitled to perform such interactions. The former concern involves an issue of privacy, the latter an issue of authenticity.
The “man-in-the-middle” attack is not a present concern. Since GPFN has no plans to conduct on-line financial transactions at this time, there is little reason for a malefactor to attempt to hijack data transmissions from the UMS. At the same time, most users and volunteers will be using GPFN’s own modems to connect to the system further minimizing the chance for intercepting data transmissions. However, the requirement to support SSL encrypted connections may be added in the future.
The issue of user authentication is more pressing. The database should be secured so that only applications on the local host can access the data with write privileges. The application level should be designed so that user authentication is required before accessing the system and once authenticated a user’s credentials are maintained for the duration of the session. Once a session is finished or a time limit expired, these credentials must be revoked.
User authentication is important for both user access and volunteer access to the system. In the former case, it must be absolutely guaranteed that a user will never be able to access another user’s data. Similarly, it must be absolutely guaranteed that only approved GPFN volunteers will have access to the information of any user.
The proposed system will be implemented by volunteers. This reality has a number of constituent consequences:
- Volunteers work at their own pace and may not be prepared to meet arbitrarily imposed deadlines.
- Volunteers will be working on their own time and from their own homes making it difficult to formalize project meetings or other team get-togethers.
- Volunteers have a wide range of skills and a wide range of competencies within each skill set. The design must include a variety of tasks for volunteers of every skill set and ability.
- To implement the system in the quickest manner, a phased approach should be adopted so that basic functionalities can be built and the system put into service at the earliest available date.