11. Legally and technically securing E-Commerce Flashcards
What is good E-Commerce Security?
- To achieve highest degree of security
- new technologies
- Organizational policies and procedures
- Industry standards and government laws
- Other factors
- time value of money
- Cost of security vs. potential loss
- Securty often breaks at weakest link
Customer and merchant perspective on the different dimensions of E-commerce security
- Confidentially
→ can someone other than the addressed person read my messages? (customer)
→ are messages or confidential data accessible to anyone other than those authorized to view them? (merchant)
- Authenticy
→ Who am I dealing with? (customer)
→ What is the real identity of the customer? (merchant)
- Privacy
→ Can I control the use of information about myself? (customer)
→ What use, if any, can be made of personal data collected as part of an E-Commerce transaction? (Merchant)
- Integrity
→ Has information I transmitted or received been altered? (customer)
→ Has data on the site been altered without authorization? (merchant)
- Nonrepudiation
→ Can a party to an action with me lter deny taking the action? (customer)
→ Can a customer deny ordering products? (merchant)
- Availability
→ Can I get access to the site? (customer)
→ Is the site operational?
The tension between security and other values
-
ease of use:
- The more security measures added, the more difficult a site is to use and the slower it becomes
- too much security can harm profitability while not enough security can potentially out you out of business
-
Public Safety and criminal uses of the internet
- Tension between tthe desires of individuals to act anonymously and the needs of public officials to maintain public safety
- Use of Technology by criminals to plan crimes or threaten nation-state
- the internet also provides terrorists with convenient communications channels
Most common security Threats in the E-commerce environment
- Malicious code
- viruses
- worms
- trojan horses
- drive-by downloads
- backdoors
- bots, botnets
- threats at both client and server levels
Potentially unwanted programs (PUPs)
= Malware = any software intentionally ddesigned to cause damage to a computer or server
- Broweser parasites
- Adware
- Spyware
Phishing
- E-mail scams
- Social engineering
- Identity theft
Hacking
- Hackers vs. crackers
- Types of hackers: White black grey hats
- Hacktivism
Cybervandalism
= disrupting, defacing, desroying website
Data Breach
= losing control over corporate information to outsiders
Credit card fraud/theft
= hackers target merchant server, use data to establish credit under false identity
Denial of Services (DoS)
= attack: hackers flood site wih useless traffic to overwhelm network
Sniffing
= eavesdropping program that monitors information traveling over a network
Encryption
- transforms data into cipher text readable only by sender and receiver
- Secures stored information and information transmission
- Provides 4 of 6 Key dimensions of E-commerce Security
- message integrity
- nonrepudiationAuthendtication
- Confidentially
Firewall
- hardware or software
- uses security policy to filter packets
- two main methods
- packet filters
- Application gateways
Proxy servers
- software servers that handle all communications originating from or being sent to the internet
