No system can be secure unless good security practices are employed by the developers of the system and by those charged with running the system on a daily basis. iWay Service Manager uses advanced security mechanisms to acquire and emit protected messages, and to work with those messages during their transit through the server. iWay assumes good security practices by those running the server, including:

• Generation of private keys and acquisition/distribution of public keys and certificates.

  Note: iWay recommends the use of secure utilities for this purpose. As standards vary between users and countries, iWay does not offer these tools except for testing and demonstration purposes.

• Protection of configuration passwords.
• Physical protection of the software itself from detailed inspection and modification.
• Management of secure files, such as key stores and trust stores by the appropriate software.

  Note: iWay recommends the use of secure utilities for this purpose. As standards vary between users and countries, iWay does not offer these tools except for testing and demonstration purposes.

• Employment of good security practices including proper testing and validation of the software.

Users should protect their private keys. In particular, this means physical access to the machine must be protected. Should a private key become compromised, others could potentially gain access to sensitive information or forge digital signatures.