7 Website Security

Setting up SSL on your web server prevents any interception of information sent to and from the MyID website.

You must review the following security considerations for the MyID website:

• SSL/TLS on the MyID website
• MyID server-to-server web services
• Firewall
• Secure session cookie
• Click jacking
• Remove details of the IIS server from the HTTP headers

Some of the suggestions in this section apply to more than the MyID website. There is a choice between applying these to the individual MyID websites or to the Default Web Site. If there no websites other than those belonging to MyID, you are recommended to apply the changes to the Default Web Site. Otherwise the IIS administrator is recommended to make an informed choice based on the requirements of the other websites that share a server with MyID.