Best practices for ASPs handling Enterprise customer data?
kubrick: owasp.org, the top ten most common vulnerabilities in particular.Separation-of-duties among your employees.If your ASP involves a webapp, consider a web application gateway/firewall that 'knows' your app and what the valid input should be.If your webapp runs apache, run, do not walk, to mod_security and mod_evasive.IPS.Encrypt sensitive data using strong encryption (AES-256 or better for symmetric side). Guard access to the private keys: make a realistic, detailed policy about who gets access to them, and audit to be sure it's really being followed.Take a look at the PCI DSS (google it) -- even if you're not storing credit card data, it's a way to get a good idea about realistic, solid security.