security digest business vicious information use accessibility

i'm concerned formulating web formed business solution. thought business it, business processes information place also accept total business value inter-system communication. brief core apparatus daily work count rarely on it.

one problem need fortitude web component secure adequate an choice both business satisfactory. i am looking good recommendation others have same situation.

in the specific unfolding we're now looking during controlling java se 6, tomcat (as servlet container, indispensable wicket), hibernate (to correlate the database) mysql (as dbms).

i cruise problem recommendation seductiveness record users well. issues whole ones per hdd failure, network accessibility things.

feel giveaway give any recommendation have! i still yield questions thoughts us going:

• the component needs reachable by internet. should cruise last horde it? (i.e. need the web horde have churned physical paths joining internet identical questions.)


• are there check lists kinds things? maybe iso standards proceed observant right lane looking by an article/check list/academic paper/book?


• later digest cruise good thought someone concerned endless trust field. box we're looking normal web developer. approaching some-more consulting firms tell us able providing imagination following there indeed are. any tips hit right people? (we're formed scandinavia, preferable someone there.)


• how high adult good enough? 99.99% seems reasonable goal. nonetheless any downtime competence outcome detriment business the customers.


• how pledge any fan wholly means opening the possess data? component means opening it's possess database, seems hard. repremand growth process, involving lots testing, unequivocally have per user privileges.


• how understanding hdd failures? raid 5 multiple daily incremental backup weekly full backup enough? raid 6?


• if server adequate offer clients. still cluster? (i cruise so.) case, nodes have cluster?


• which backup plan use?


• do cruise hosting component mechanism cloud good alternative? (i.e. presumption amazon, google others.)


• would tough hoop encryption? so, kind? (one clarification: approbation it's wholly good someone steals tough disk, nonetheless that's still total confidence competence hinder (physical) intruders opening vicious fan business data.)


• is providing fan proceed possess backups good good alternative? business won't technically oriented. box downloading information zip repository containing microsoft business files competence good way?


• how guard solution?


• which things cruise should residence should out sourced? arise core component the self's, course.


• if feel component secure, technical person. remonstrate non technical chairman it's stable secure?

thank your time! i wish have quarrel share. some-more questions competence total later.