Ec2009 ch10 e commerce security

Chapter 10 E-Commerce Security

Learning Objectives Document the rapid rise in computer and network security attacks. Describe the common security practices of businesses of all sizes. Understand the basic elements of EC security. Explain the basic types of network security attacks.

Learning Objectives (cont.) Describe common mistakes that organizations make in managing security. Discuss some of the major technologies for securing EC communications. Detail some of the major technologies for securing EC networks components.

Brute Force Credit Card Attack Story The Problem Spitfire Novelties usually generates between 5 and 30 transactions per day On September 12, 2002 in a “brute force” credit card attack, Spitfire’s credit card transaction processor processed 140,000 fake credit card charges worth $5.07 each (62,000 were approved)

Brute Force Credit Card Attack (cont.) The total value of the approved charges was around $300,000 Spitfire found out about the transactions only when they were called by one of the credit card owners who had been checking his statement online and had noticed the $5.07 charge

Brute Force Credit Card Attack (cont.) Brute force credit card attacks require minimal skill Hackers run thousands of small charges through merchant accounts, picking numbers at random When the perpetrator finds a valid credit card number it can then be sold on the black market Some modern-day black markets are actually member-only Web sites like carderplanet.com , shadowcrew.com , and counterfeitlibrary.com

Brute Force Credit Card Attack (cont.) Relies on a perpetrator’s ability to pose as a merchant requesting authorization for a credit card purchase requiring A merchant ID A password Both

Brute Force Credit Card Attack (cont.) Online Data’s credit card processing services, all a perpetrator needed was a merchant’s password in order to request authorization Online Data is a reseller of VeriSign Inc. credit card gateway services VeriSign blamed Online Data for the incident Online Data blamed Spitfire for not changing their initial starter password

Brute Force Credit Card Attack Story (cont.) In April 2002 hackers got into the Authorize.Net card processing system (largest gateway payment system on the Internet) Executed 13,000 credit card transactions, of which 7,000 succeeded Entry into the Authorize.Net system required only a log-on name, not a password

Brute Force Solution Online Data should assign strong passwords at the start Customers should modify those passwords frequently Authorization services such as VeriSign and Authorize.Net should have built-in safeguards that recognize brute force attacks

Brute Force Credit Card Solution (cont.) Signals that something is amiss: A merchant issues an extraordinary number of requests Repeated requests for small amounts emanating from the same merchants

Brute Force Credit Card Attack (cont.) The Results VeriSign halted the transactions before they were settled, saving Spitfire $316,000 in charges Authorize.Net merchants were charged $0.35 for each transaction The criminals acquired thousands of valid credit card numbers to sell on the black market

Brute Force Credit Card Attack (cont.) What we can learn… Any type of EC involves a number of players who use a variety of network and application services that provide access to a variety of data sources A perpetrator needs only a single weakness in order to attack a system

Brute Force What We Can Learn Some attacks require sophisticated techniques and technologies Most attacks are not sophisticated; standard security risk management procedures can be used to minimize their probability and impact

Accelerating Need for E-Commerce Security Annual survey conducted by the Computer Security Institute and the FBI Organizations continue to experience cyber attacks from inside and outside of the organization The types of cyber attacks that organizations experience were varied The financial losses from a cyber attack can be substantial It takes more than one type of technology to defend against cyber attacks

Accelerating Need for E-Commerce Security (cont.) National Infrastructure Protection Center (NIPC): A joint partnership, under the auspices of the FBI, among governmental and private industry; designed to prevent and protect the nation’s infrastructure

Accelerating Need for E-Commerce Security (cont.) Computer Emergency Response Team (CERT): Group of three teams at Carnegie Mellon University that monitors incidence of cyber attacks, analyze vulnerabilities, and provide guidance on protecting against attacks

Accelerating Need for E-Commerce Security (cont.) According to the statistics reported to CERT/CC over the past year (CERT/CC 2002) The number of cyber attacks skyrocketed from approximately 22,000 in 2000 to over 82,000 in 2002 First quarter of 2003 the number was already over 43,000

Security Is Everyone’s Business Security practices of organizations of various sizes Small organizations (10 to 100 computers) The “haves” are centrally organized, devote a sizeable percentage of their IT budgets to security The “have-nots” are basically clueless when it comes to IT security

Security Is Everyone’s Business (cont.) Medium organizations (100 to 1,000 computers) Rarely rely on managerial policies in making security decisions, and they have little managerial support for their IT policies The staff they do have is poorly educated and poorly trained—overall exposure to cyber attacks and intrusion is substantially greater than in smaller organizations

Security Is Everyone’s Business (cont.) Large organizations (1,000 to 10,000 computers) Complex infrastructures and substantial exposure on the Internet While aggregate IT security expenditures are fairly large, their security expenditures per employee are low

Security Is Everyone’s Business (cont.) Larger organizations IT security is part-time and undertrained—sizeable percentage of the large organizations suffer loss or damage due to incidents Base their security decisions on organizational policies

Security Is Everyone’s Business (cont.) Very large organizations (more than 10,000 computers) extremely complex environments that are difficult to manage even with a larger staff rely on managerial policies in making IT security decisions only a small percentage have a well-coordinated incident response plan

Security Issues From the user’s perspective: Is the Web server owned and operated by a legitimate company? Does the Web page and form contain some malicious or dangerous code or content? Will the Web server distribute unauthorized information the user provides to some other party?

Security Issues (cont.) From the company’s perspective: Will the user not attempt to break into the Web server or alter the pages and content at the site? Will the user will try to disrupt the server so that it isn’t available to others?

Security Issues (cont.) From both parties’ perspectives: Is the network connection free from eavesdropping by a third party “listening” on the line? Has the information sent back and forth between the server and the user’s browser been altered?

Security Requirements Authentication: The process by which one entity verifies that another entity is who they claim to be Authorization: The process that ensures that a person has the right to access certain resources

Security Requirements (cont.) Auditing: The process of collecting information about attempts to access particular resources, use particular privileges, or perform other security actions

Security Requirements (cont.) Confidentiality: Keeping private or sensitive information from being disclosed to unauthorized individuals, entities, or processes

Security Requirements (cont.) Integrity: As applied to data, the ability to protect data from being altered or destroyed in an unauthorized or accidental manner

Security Issues (cont.) Nonrepudiation : The ability to limit parties from refuting that a legitimate transaction took place, usually by means of a signature

Types of Threats and Attacks Nontechnical attack: An attack that uses chicanery to trick people into revealing sensitive information or performing actions that compromise the security of a network

Types of Threats and Attacks (cont.)

Types of Threats and Attacks (cont.) Social engineering: A type of nontechnical attack that uses social pressures to trick computer users into compromising computer networks to which those individuals have access

Types of Threats and Attacks (cont.) Multiprong approach used to combat social engineering: Education and training Policies and procedures Penetration testing

Types of Threats and Attacks (cont.) Technical attack: An attack perpetrated using software and systems knowledge or expertise

Types of Threats and Attacks (cont.) Common (security) vulnerabilities and exposures (CVEs): Publicly known computer security risks, which are collected, listed, and shared by a board of security-related organizations ( cve.mitre.org )

Types of Threats and Attacks (cont.) Denial-of-service (DoS) attack: An attack on a Web site in which an attacker uses specialized software to send a flood of data packets to the target computer with the aim of overloading its resources

Types of Threats and Attacks (cont.) Distributed denial-of-service (DDoS) attack: A denial-of-service attack in which the attacker gains illegal administrative access to as many computers on the Internet as possible and uses these multiple computers to send a flood of data packets to the target computer

Distributed denial-of-service (DDoS)

Types of Threats and Attacks (cont.) Malware: A generic term for malicious software The severity of the viruses increased substantially, requiring much more time and money to recover 85% of survey respondents said that their organizations had been the victims of e-mail viruses in 2002

Types of Threats and Attacks (cont.) Malicious code takes a variety of forms—both pure and hybrid Virus: A piece of software code that inserts itself into a host, including the operating systems, to propagate; it requires that its host program be run to activate it

Types of Threats and Attacks (cont.) Worm: A software program that runs independently, consuming the resources of its host in order to maintain itself and is capable of propagating a complete working version of itself onto another machine

Types of Threats and Attacks (cont.) Macro virus or macro worm: A virus or worm that is executed when the application object that contains the macro is opened or a particular procedure is executed

Types of Threats and Attacks (cont.) Trojan horse: A program that appears to have a useful function but that contains a hidden function that presents a security risk

Managing EC Security Common mistakes in managing their security risks (McConnell 2002): Undervalued information Narrowly defined security boundaries Reactive security management Dated security management processes Lack of communication about security responsibilities

Managing EC Security (cont.) Security risk management: A systematic process for determining the likelihood of various security attacks and for identifying the actions needed to prevent or mitigate those attacks

Managing EC Security (cont.) Phases of security risk management Assessment Planning Implementation Monitoring

Managing EC Security (cont.) Phase 1: Assessment Evaluate security risks by determining assets, vulnerabilities of their system, and potential threats to these vulnerabilities

Honeynet: A way to evaluate vulnerabilities of an organization by studying the types of attacks to which a site is subjected, using a network of systems called honeypots Honeypots: Production systems (e.g., firewalls, routers, Web servers, database servers) designed to do real work but to be watched and studied as network intrusions occur

Managing EC Security (cont.) Phase 2: Planning Goal of this phase is to arrive at a set of policies defining which threats are tolerable and which are not Policies also specify the general measures to be taken against those threats that are intolerable or high priority

Managing EC Security (cont.) Phase 3: Implementation Particular technologies are chosen to counter high-priority threats First step is to select generic types of technology for each of the high priority threats

Managing EC Security (cont.) Phase 4: Monitoring to determine Which measures are successful Which measures are unsuccessful and need modification Whether there are any new types of threats Whether there have been advances or changes in technology Whether there are any new business assets that need to be secured

Managing EC Security (cont.) Methods of securing EC Authentication system Access control mechanism Passive tokens Active tokens

Authentication Authentication system: System that identifies the legitimate parties to a transaction, determines the actions they are allowed to perform, and limits their actions to only those that are necessary to initiate and complete the transaction

Authentication (cont.) Access control mechanism: Mechanism that limits the actions that can be performed by an authenticated person or group

Authentication (cont.) Passive tokens: Storage devices (e.g., magnetic strips) used in a two-factor authentication system that contain a secret code

Authentication (cont.) Active tokens: Small, stand-alone electronic devices in a two factor authentication system that generate one-time passwords Who goes there?

Biometric Controls Biometric systems: Authentication systems that identify a person by measurement of a biological characteristic such as a fingerprint, iris (eye) pattern, facial features, or voice

Biometric Controls (cont.) Physiological biometrics: Measurements derived directly from different parts of the body (e.g., fingerprints, iris, hand, facial characteristics) Behavioral biometrics: Measurements derived from various actions and indirectly from various body parts (e.g., voice scans or keystroke monitoring)

Biometric Controls (cont.) Fingerprint scanning: Measurement of the discontinuities of a person’s fingerprint, converted to a set of numbers that are stored as a template and used to authenticate identity Iris scanning: Measurement of the unique spots in the iris (colored part of the eye), converted to a set of numbers that are stored as a template and used to authenticate identity

Biometric Controls (cont.) Voice scanning: Measurement of the acoustical patterns in speech production, converted to a set of numbers that are stored as a template and used to authenticate identity

Biometric Controls (cont.) Keystroke monitoring: Measurement of the pressure, speed, and rhythm with which a word is typed, converted to a set of numbers that are stored as a template and used to authenticate identity; this biometric is still under development

Encryption Methods Public key infrastructure (PKI): A scheme for securing e-payments using public key encryption and various technical components

Public key infrastructure (PKI)

Encryption Methods (cont.) Private and public key encryption Encryption: The process of scrambling (encrypting) a message in such a way that it is difficult, expensive, or time-consuming for an unauthorized person to unscramble (decrypt) it

Encryption Methods (cont.) Plaintext: An unencrypted message in human-readable form Ciphertext: A plaintext message after it has been encrypted into a machine-readable form Encryption algorithm: The mathematical formula used to encrypt the plaintext into the ciphertext, and vice versa

Encryption Methods (cont.) Symmetric (private) key system Key: The secret code used to encrypt and decrypt a message Symmetric (private) key system: An encryption system that uses the same key to encrypt and decrypt the message

Encryption Methods (cont.) Data Encryption Standard (DES): The standard symmetric encryption algorithm supported the NIST and used by U.S. government agencies until October 2, 2000 Rijndael: The new Advanced Encryption Standard used to secure U.S. government communications since October 2, 2000

Elements of PKI Digital signature: An identifying code that can be used to authenticate the identity of the sender of a document Portable Cannot be easily repudiated or imitated, and can be time-stamped

Elements of PKI (cont.) Digital signatures include: Hash: A mathematical computation that is applied to a message, using a private key, to encrypt the message Message digest: A summary of a message, converted into a string of digits, after the hash has been applied Digital envelope: The combination of the encrypted original message and the digital signature, using the recipient’s public key

Elements of PKI (cont.) Digital certificate: Verification that the holder of a public or private key is who they claim to be Certificate authorities (CAs): Third parties that issue digital certificates

Security Protocols Secure Socket Layer (SSL): Protocol that utilizes standard certificates for authentication and data encryption to ensure privacy or confidentiality Transport Layer Security (TLS): As of 1996, another name for the SSL protocol

Security Protocols (cont.) Secure Electronic Transaction (SET): A protocol designed to provide secure online credit card transactions for both consumers and merchants; developed jointly by Netscape, Visa, MasterCard, and others

Secure Electronic Transaction (SET) The customer obtains a credit card account with a bank that supports electronic payment and SET The customer receives an X.509v3 digital certificate signed by the bank. Merchants have their own certificates The customer places an order The merchant sends a copy of its certificate so that the customer can verify that it's a valid store The order and payment are sent The merchant requests payment authorization The merchant confirms the order The merchant ships the goods or provides the service to the customer The merchant requests payment

Securing EC Networks Technologies for organizational networks Firewall: A network node consisting of both hardware and software that isolates a private network from a public network Packet-filtering routers: Firewalls that filter data and requests moving from the public Internet to a private network based on the network addresses of the computer sending or receiving the request

Securing EC Networks (cont.) Packet filters: Rules that can accept or reject incoming packets based on source and destination addresses and the other identifying information Application-level proxy: A firewall that permits requests for Web pages to move from the public Internet to the private network

Securing EC Networks (cont.) Bastion gateway: A special hardware server that utilizes application-level proxy software to limit the types of requests that can be passed to an organization’s internal networks from the public Internet Proxies: Special software programs that run on the gateway server and pass repackaged packets from one network to the other

Securing EC Networks (cont.) Personal firewalls: Personal firewall: A network node designed to protect an individual user’s desktop system from the public network by monitoring all the traffic that passes through the computer’s network interface card

Securing EC Networks (cont.) VPNs Virtual private network (VPN): A network that uses the public Internet to carry information but remains private by using encryption to scramble the communications, authentication to ensure that information has not been tampered with, and access control to verify the identity of anyone using the network

Securing EC Networks (cont.) Protocol tunneling: Method used to ensure confidentiality and integrity of data transmitted over the Internet, by encrypting data packets, sending them in packets across the Internet, and decrypting them at the destination address

Securing EC Networks (cont.) Intrusion detection systems (IDSs): A special category of software that can monitor activity across a network or on a host computer, watch for suspicious activity, and take automated action based on what it sees

Securing EC Networks (cont.) Network-based IDS uses rules to analyze suspicious activity at the perimeter of a network or at key locations in the network Consists of a monitor—a software package that scans the software agents that reside on various host computers and feed information back to the monitor

Managerial Issues Have we budgeted enough for security? What are the business consequences of poor security? Which e-commerce sites are vulnerable to attack?

Managerial Issues (cont.) What is the key to establishing strong e-commerce security? What steps should businesses follow inestablishing a security plan? Should organizations be concerned with internal security threats?

Summary Increase in computer attacks. Security is everyone’s business. Basic security issues. Basic types of network security attacks. Managing EC security. Securing EC communications. Technologies for securing networks

Ec2009 ch10 e commerce security

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Ec2009 ch10 e commerce security (20)

More from Nuth Otanasap (20)

Recently uploaded (20)

Ec2009 ch10 e commerce security