The design should include
- using Secure Sockets Layer (SSL) protocol to encrypt data communicated in the application
- asserting a user via authentication (e.g., “Who are you?”) that requires a username and password
- protecting restricted resources with authorization (e.g., “What can you do?”), using role-based security
- storing sensitive data (e.g., passwords) via encryption.