E-commerce: Password enforcements

When you need to step back.

The customers management needs to be not only informed but made to sign off, at a senior level(CIO,CEO), that this is what they want to do.

Even then you might be within your rights to say no.... You have the right to provide the service within parameters, and even if they accept responsibility, and there is no legal damage if fraud occurs, your company's reputation would still suffer if fraud took place on your site.

James

1) "- Does the E-Commerce hosting site have any exposure? If fraud was committed, does the E-Commerce host site have any liability." would best be answered by your attourney.

2) "- In general, does the E-Commerce hosting site have any responsibility for protecting clients from making requests potential injurous to themselves? Or should they just do whatever the client (wants) if it only affects the client?" I think that customer service is beyond "let the buyer beware" and provides information that may be useful, but allows them to make the decision if possible. I would let them ( either the customer or your marketers- as appropriate) know in a very respectful letter that there are some downsides to this (security risks), and also that you see some upsides (it's easier for them for one) and that you would be happy to go ahead with whatever they desire (and your attourney says is ok), but you just wanted them to know about it. Hey, I would want the salesman to tell me if the car Iwas buying had a bad set of brakes or whatever, but I still may want the car :)

I think people who are requesting the change need to be educated about the risks and have them sign a Service Agreement.
Get a lawyer involve because if the server gets compromised the blame will on the provider shoulder.
The provider needs to insist in this case because it is his network that is going to be compromised and I garantee you that sooner or latter that common password will be all over the place.
-Monitoring account will be an issue too.
I hope this help.

Raymond M. Sbnetsecurity.com

You must educate your non-technical managers of the implications of using ANY other solution that one password = one client. Without doing this on an e-commerce site, if fraud is commited by one of the users of the site, under the one password withmultiple users there is NO WAY you as the system administrator could trace back any problem (non malicious or otherwise) and then the legal onus gets placed on your company, not any of the clients. You can not effectively use any kind of auditing or really do any kind of protection of your company.

This really is a situation created by the non-teckie folks who always want things as simple as possible and cant't be bothered with the technical or legal stuff - dangerous people indeed.

If you can't convince your management to side with you - then a SLA with all the legalese to tell the client - hey, you can do this dumb thing with the password, but then you can not come back to us and try and blame use for your lazy attitude about security.

If management wouldn't support you with a one client = one password, or the legal SLA to get you off the hook, you've got problems because it's your butt on the line

Just some thoughts from someone who's been there.