SSL IS NOT ENOUGH
One of the major misconceptions regarding internet security is that information submitted to a server using SSL will always remain encrypted and secure. This is not true. A secure (SSL) server alone does nothing to protect the data after it is received by the server. SSL creates a secure path between the user's browser and the SSL-enabled server. However, the information is only secure during the time that it is being transmitted from the browser to the server. Once the information reaches the server, the information is decrypted and SSL has no effect. If there is no further encryption taking place once the information reaches the server, the security of the information is compromised |