Unit 2aa
Download as PPT, PDF0 likes1,130 views
This document discusses various techniques for achieving security in e-commerce, including encryption methods, digital certificates, public key infrastructure (PKI), and securing communication channels. It describes symmetric and asymmetric encryption, digital signatures, certification authorities, and how firewalls, SSL, and S-HTTP can be used to establish secure connections and transmit encrypted data between clients and servers on the internet. The document also outlines common security threats like viruses, hacking, and denial of service attacks, and examines how tools like encryption, firewalls, and digital certificates work to address vulnerabilities and achieve the goals of security, integrity, authentication and privacy in e-commerce.
![Copyright © 2010
Pearson Education, Inc.
Virtual Private Network (VPN)
Allows remote users to securely access internal
network via the Internet, using Point-to-Point
Tunneling Protocol (PPTP)
It enables a host computer to send and receive data
across shared or public networks as if it were a
private network with all the functionality, security and
management policies of the private network.[1]This is
done by establishing a virtual point-to-
point connection through the use of dedicated
connections, encryption, or a combination of the two.](https://image.slidesharecdn.com/unit2aa-130701090333-phpapp01/85/Unit-2aa-48-320.jpg)
Unit 2aa
- 1. Copyright © 2010 Pearson Education, Inc.Copyright © 2009 Pearson Education, Inc. Slide 5-1 Unit 2 Security Issues in E- Business
- 2. Copyright © 2010 Pearson Education, Inc. Types of Attacks Against Computer Systems (Cybercrime) Slide 5-2 Figure 5.1, Page 267 Source: Based on data from Computer Security Institute, 2009.
- 3. Copyright © 2010 Pearson Education, Inc. What Is Good E-commerce Security? To achieve highest degree of security New technologies Organizational policies and procedures Industry standards and government laws
- 4. Copyright © 2010 Pearson Education, Inc. The E-commerce Security Environment Figure 5.2, Page 270 Slide 5-4
- 5. Copyright © 2010 Pearson Education, Inc. Dimension of E-Commerce Security 1.Integrity- the ability to ensure that information being displayed on a web site or transmitted or received over the internet has not been altered in any way by an unauthorized party. 2.Non-repudiation – the ability to ensure that e-commerce participants do not deny their online actions.
- 6. Copyright © 2010 Pearson Education, Inc. 3. Authenticity- the ability to identify the identity of a person or entity with whom you are dealing on the internet. 4. Confidentiality – the ability to ensure that messages and data are available only to those who are authorized to view them.
- 7. Copyright © 2010 Pearson Education, Inc. 5. Privacy- the ability to control the use of information about oneself. 6. Availability – the ability to ensure that an e- commerce site continues to function as intended.
- 8. Copyright © 2010 Pearson Education, Inc. Table 5.2, Page 271 Slide 5-8
- 9. Copyright © 2010 Pearson Education, Inc. The Tension Between Security and Other Values Security vs. ease of use The more security measures added, the more difficult a site is to use, and the slower it becomes Security vs. desire of individuals to act anonymously Use of technology by criminals to plan crimes or threaten nation-state Slide 5-9
- 10. Copyright © 2010 Pearson Education, Inc. Security Threats in the E-commerce Environment Three key points of vulnerability: 1. Client 2. Server 3. Communications pipeline Slide 5-10
- 11. Copyright © 2010 Pearson Education, Inc. Most Common Security Threats in the E-commerce Environment Malicious code Viruses (replicate, make copies of itself) Worms (spread from computer to computer) Trojan horses (appears to be benign, but then does something other than expected) Bots (respond to external command sent by the attacker) Botnets (collection of bot computers) Slide 5-11
- 12. Copyright © 2010 Pearson Education, Inc. Unwanted programs Browser parasites (a browser that can monitor and change the settings of a user’s browser) Spyware ( a program used to obtain information such as user emails, IM and so on.) Phishing Deceptive online attempt by a third party to obtain confidential information for Financial gain Use information to commit fraudulent acts (access checking accounts), steal identity Slide 5-12
- 13. Copyright © 2010 Pearson Education, Inc. Hacking and cybervandalism Hackers (individual who intends to gain unauthorized access to a computer system) Crackers (term used to denote hacker with criminal intent) Cybervandalism: intentionally disrupting, defacing, destroying a Web site Types of hackers: white hats (good hackers), black hats (intention of causing harm), grey hats (discover the weakness and publish it)
- 14. Copyright © 2010 Pearson Education, Inc. Credit card fraud/theft Fear of stolen credit card information deters online purchases Online companies at higher risk than offline Spoofing: misrepresenting self by using fake e-mail address Pharming: spoofing a Web site Redirecting a Web link to a new, fake Web site Spam/junk Web sites Slide 5-14
- 15. Copyright © 2010 Pearson Education, Inc. Denial of service (DoS) attack Hackers flood site with useless traffic to overwhelm network Distributed denial of service (DDoS) attack Hackers use multiple computers to attack target network Sniffing- Eavesdropping program that monitors information traveling over a network Insider jobs - Single largest financial threat Poorly designed server and client software
- 16. Copyright © 2010 Pearson Education, Inc. Technology Solutions Protecting Internet communications (encryption) Securing channels of communication (SSL, S- HTTP, VPNs) Protecting networks (firewalls) Protecting servers and clients Slide 5-16
- 17. Copyright © 2010 Pearson Education, Inc. Tools Available to Achieve Site Security Figure 5.7, Page 287 Slide 5-17
- 18. Copyright © 2010 Pearson Education, Inc. Encryption is the coding of information by using a mathematically based program and a secret key to produce a string of characters that is unintelligible. Science that studies encryption is called cryptography (secret writing). Science of creating messages that only the sender and receiver can read.
- 19. Copyright © 2010 Pearson Education, Inc. Encryption Transforms data (plain text) into cipher text readable only by sender and receiver Secures stored information and information transmission Provides 4 of 6 key dimensions of e- commerce security: 1. Message integrity (unaltered) 2. Nonrepudiation (can’t deny the action) 3. Authentication (verify identity) 4. Confidentiality (message not read by others) Slide 5-19
- 20. Copyright © 2010 Pearson Education, Inc. Plaintext- An unencrypted message in human- readable form Ciphertext- A plaintext message after it has been encrypted into a machine-readable form Substitution Cipher - Cipher is letter plus two So Hello will replace by letter two places forward Transposition Cipher – Change in order in a symmetric way eg. Hello- reverse it Olleh.
- 21. Copyright © 2010 Pearson Education, Inc. Symmetric Key Encryption (Secret/private Key Encryp.) Sender and receiver use same digital key to encrypt and decrypt message Requires different set of keys for each transaction -Data Encryption Standard (DES) developed by National Security Agency (NSA) and IBM in 1950s.Uses 56- bit encryption key. U.S. Gov. uses 3DES Advanced Encryption Standard (AES) -Most widely used symmetric key encryption Uses 128-, 192-, and 256-bit encryption keys -Other standards use keys with up to 2,048 bits
- 22. Copyright © 2010 Pearson Education, Inc. Public Key Encryption (Asymmetric encryption) Uses two mathematically related digital keys 1. Public key (widely disseminated) 2. Private key (kept secret by owner) Both keys used to encrypt and decrypt message Once key used to encrypt message, same key cannot be used to decrypt message Sender uses recipient’s public key to encrypt message; recipient uses his/her private key to decrypt it
- 23. Copyright © 2010 Pearson Education, Inc. Public Key Cryptography—A Simple Case Figure 5.8, Page 290 Slide 5-23
- 24. Copyright © 2010 Pearson Education, Inc. Public Key Encryption Using Digital Signatures and Hash Digests Hash function: Mathematical algorithm that produces fixed- length number called message or hash digest Hash digest of message sent to recipient along with message to verify integrity Property of hash function –any change in the original message will cause the message digest to be different Slide 5-24
- 25. Copyright © 2010 Pearson Education, Inc. Digital Signature (e- signature) - To verify authenticity of message and message integrity. - signed Cipher text that can be sent over the internet - With hash document, it is unique for the document, and changes for every document.
- 26. Copyright © 2010 Pearson Education, Inc. Public Key Cryptography with Digital Signatures Figure 5.9, Page 291 Slide 5-26
- 27. Copyright © 2010 Pearson Education, Inc. Public Key Encryption Using Digital Signatures and Hash Digests 1.The sender creates an original message 2.The sender applies a hash function, producing a 128- bit hash result. 3.The sender encrypts the message and hash result using recipient’s public key. 4.The sender encrypts the result ,again his or her private key. 5.The result of this double encryption is sent over the internet. 6.The receiver uses the sender’s public key to authenticate the message. 7.The receiver uses his /her private key to decrypt the hash function and the original message. The receiver checks to ensure the original message and the hash function results conform to one another.
- 28. Copyright © 2010 Pearson Education, Inc. Digital Envelopes (key within a key) Addresses weaknesses of: - Public key encryption: Computationally slow, decreased transmission speed, increased processing time - Symmetric key encryption: Insecure transmission lines Uses symmetric key encryption to encrypt document Uses public key encryption to encrypt and send symmetric key Slide 5-28
- 29. Copyright © 2010 Pearson Education, Inc. Creating a Digital Envelope Figure 5.10, Page 293 Slide 5-29
- 30. Copyright © 2010 Pearson Education, Inc. What are Digital Certificates? A digital certificate (DC) is a digital file that certifies the identity of an individual or institution, or even a router seeking access to computer- based information. It is issued by a Certification Authority (CA), and serves the same purpose as a driver’s license or a passport.
- 31. Copyright © 2010 Pearson Education, Inc. Digital Certificates Digital certificate is a digital document issued by a certification authority. It includes: Name of subject/company Subject’s public key Digital certificate serial number Expiration date, issuance date Digital signature of certification authority (trusted third party institution) that issues certificate Other identifying information Certification authority (CA): A trusted third party that issues digital certificates Slide 5-31
- 32. Copyright © 2010 Pearson Education, Inc. What are Certification Authorities? Certification Authorities are the digital world’s equivalent to passport offices. They issue digital certificates and validate holders’ identity and authority. They embed an individual or institution’s public key along with other identifying information into each digital certificate and then cryptographically sign it as a tamper-proof seal verifying the integrity of the data within it, and validating its use.
- 33. Copyright © 2010 Pearson Education, Inc. Public Key Infrastructure (PKI) It is a comprehensive system which is required to provide public key encryption and digital signature services. PKI is the combination of software, encryption technologies and services that enables enterprises to protect the security of their communications and business transaction on networks. It integrates CAs, digital certificate, public key cryptography into total, enterprise wide security architecture. The purpose of PKI is to manage keys and certificates.
- 34. Copyright © 2010 Pearson Education, Inc. PKI involves the following a) Subscriber- individual or entity identified by the certificate b) Certifying authority- issuer of the certificate c) Relying party- company, agency, or individual relying on the certificate. Role of CA 1)To issue digital certificate to the subscriber 2) Identify and authenticate the subscriber’s information contained in the certificate for the benefit of the relying party.
- 35. Copyright © 2010 Pearson Education, Inc. A PKI infrastructure is expected to offer its users the following benefits: certainty of the quality of information sent and received electronically certainty of the source and destination of that information assurance of the time and timing of that information (providing the source of time is known) certainty of the privacy of that information assurance that the information may be introduced as evidence in a court or law
- 36. Copyright © 2010 Pearson Education, Inc. Who Provides the Infrastructure- Among PKI leaders are: RSA, which has developed the main algorithms used by PKI vendors Verisign, which acts as a certificate authority and sells software that allows a company to create its own certificate authorities GTE CyberTrust, which provides a PKI implementation methodology and consultation service that it plans to vend to other companies for a fixed price Xcert, whose Web Sentry product that checks the revocation status of certificates on a server, using the Online Certificate Status Protocol (OCSP) Netscape, whose Directory Server product is said to support 50 million objects and process 5,000 queries a second; Secure E-Commerce, which allows a company orextranet manager to manage digital certificates; and Meta- Directory, which can connect all corporate directories into a single directory for security management
- 37. Copyright © 2010 Pearson Education, Inc. Some Indian Websites that uses digital signature - Rediff, Sify-mall, Bazee,All major airlines ,ICICI,HDFC Some Certifying Authorities in India - Safe Scrypt(A sify- verisign venture) was the first CA in India - National Informatics Centre - Tata Consultancy Services
- 38. Copyright © 2010 Pearson Education, Inc. Digital Certificates and Certification Authorities Figure 5.11, Page 294 Slide 5-38
- 39. Copyright © 2010 Pearson Education, Inc. Limits to Encryption Solutions Doesn’t protect storage of private key PKI not effective against insiders, employees Protection of private keys by individuals may be haphazard No guarantee that verifying computer of merchant is secure CAs are unregulated, self-selecting organizations Slide 5-39
- 40. Copyright © 2010 Pearson Education, Inc. Securing Channels of Communication Secure Sockets Layer (SSL developed by netscape communication): Establishes a secure, negotiated client-server session in which URL of requested document, along with contents, is encrypted (secure comm. b/w two computers) It is a protocol that operates between the transport and application layers of TCP/IP and secures communications between the clients and server (by using encryption, digital signature technique). A session key is a unique symmetric encryption key chosen just for single secure session. Slide 5-40
- 41. Copyright © 2010 Pearson Education, Inc. Secure Negotiated Sessions Using SSL Figure 5.12, Page 298 Slide 5-41
- 42. Copyright © 2010 Pearson Education, Inc. S-HTTP (developed by commercenet): Provides a secure message-oriented communications protocol designed for use in conjunction with HTTP (secure individual message) It includes encrypting web communications carried over HTTP. SSL is designed to establish a secure connection between two computers whereas S- HTTP is designed to send individual messages securely.
- 43. Copyright © 2010 Pearson Education, Inc. Firewalls Firewall a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts. Hardware or software that filters packets Prevents some packets from entering the network based on security policy Network inside the firewall is called trusted, and outside the firewall is called untrusted Slide 5-43
- 44. Copyright © 2010 Pearson Education, Inc. Three main methods: 1.Packet filters (examine all data flowing back and forth b/w the trusted n/w (within the firewall) and the Internet. 2.Application gateways (firewalls that filter traffic based on the application requested. Eg. permits incoming FTP request and blocks outgoing FTP request) 3.Proxy Server (firewall that communicate with the internet on the private network’s behalf, it is a Software servers that handle all communications originating from or being sent to the Internet).
- 45. Copyright © 2010 Pearson Education, Inc. Firewalls and Proxy Servers Figure 5.13, Page 301 Slide 5-45
- 46. Copyright © 2010 Pearson Education, Inc. Personal Firewalls A personal firewall is an application which controls network traffic to and from a computer, permitting or denying communications based on a security policy. Typically it works as an application layer firewall. A personal firewall will usually protect only the computer on which it is installed, as compared to a conventional firewall which is normally installed on a designated interface between two or more networks, such as a router or proxy server. Hence, personal firewalls allow a security policy to be defined for individual computers, whereas a conventional firewall controls the policy between the networks that it connects. Personal firewalls may also provide some level of intrusion detection, allowing the software to terminate or block connectivity where it suspects an intrusion is being attempted.
- 47. Copyright © 2010 Pearson Education, Inc. Features of personal firewalls -Protects the user from unwanted incoming connection attempts Allows the user to control which programs can and cannot access the local network and/or Internet and provide the user with information about an application that makes a connection attempt Block or alert the user about outgoing connection attempts Hide the computer from port scans by not responding to unsolicited network traffic Monitor applications that are listening for incoming connections Monitor and regulate all incoming and outgoing Internet users Prevent unwanted network traffic from locally installed applications Provide information about the destination server with which an application is attempting to communicate
- 48. Copyright © 2010 Pearson Education, Inc. Virtual Private Network (VPN) Allows remote users to securely access internal network via the Internet, using Point-to-Point Tunneling Protocol (PPTP) It enables a host computer to send and receive data across shared or public networks as if it were a private network with all the functionality, security and management policies of the private network.[1]This is done by establishing a virtual point-to- point connection through the use of dedicated connections, encryption, or a combination of the two.
- 49. Copyright © 2010 Pearson Education, Inc. - The VPN connection across the Internet is technically a wide area network (WAN) link between the sites but appears to the user as a private network link—hence the name "virtual private network". - Point-to-Point Tunneling Protocol (PPTP) is an encoding mechanism that allows one local network to connect to another using the internet as the conduit. - - VPN is a temporary secure line and it reduces the cost of secure connection.
- 50. Copyright © 2010 Pearson Education, Inc. Four Protocols used in VPN - PPTP -- Point-to-Point Tunneling Protocol - L2TP -- Layer 2 Tunneling Protocol - IPsec -- Internet Protocol Security - SOCKS – is not used as much as the ones above Tunneling- A virtual point-to-point connection made through a public network. The process of connecting one protocol (PPTP) through another (IP) is called tunneling.
- 51. Copyright © 2010 Pearson Education, Inc.
- 52. Copyright © 2010 Pearson Education, Inc.
- 53. Copyright © 2010 Pearson Education, Inc. A VPN works by using the shared public infrastructure while maintaining privacy through security procedures and tunneling protocols such as the Layer Two Tunneling Protocol (L2TP). In effect, the protocols, by encrypting data at the sending end and decrypting it at the receiving end, send the data through a "tunnel" that cannot be "entered" by data that is not properly encrypted. An additional level of security involves encrypting not only the data, but also the originating and receiving network addresses.
- 54. Copyright © 2010 Pearson Education, Inc. Eliminating the need for expensive long-distance leased lines Reducing the long-distance telephone charges for remote access. Transferring the support burden to the service providers Operational costs Advantages: Scalability Flexibility of growth Efficiency with broadband technology Advantages: Cost Savings
- 55. Copyright © 2010 Pearson Education, Inc. - VPNs require an in-depth understanding of public network security issues and proper deployment of precautions - Availability and performance depends on factors largely outside of their control - Immature standards - VPNs need to accommodate protocols other than IP and existing internal network technology Disadvantages
- 56. Copyright © 2010 Pearson Education, Inc. Definitions - Intrusion Detection Systems Intrusion A set of actions aimed to compromise the security goals, namely Integrity, confidentiality, or availability, of a computing and networking resource Intrusion detection The process of identifying and responding to intrusion activities Intrusion prevention Extension of ID with exercises of access control to protect computers from exploitation
- 57. Copyright © 2010 Pearson Education, Inc. Intrusion Detection Systems An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station.
- 58. Copyright © 2010 Pearson Education, Inc.
- 59. Copyright © 2010 Pearson Education, Inc. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. Types of IDS
- 60. Copyright © 2010 Pearson Education, Inc. Network intrusion detection system (NIDS) is an independent platform that identifies intrusions by examining network traffic and monitors multiple hosts. Network intrusion detection systems gain access to network traffic by connecting to a network hub, network switch Host-based intrusion detection system (HIDS) It consists of an agent on a host that identifies intrusions by analyzing system calls, application logs, file-system modifications and other host activities and state. Stack-based intrusion detection system (SIDS) in this,the packets are examined as they go through the TCP/IP stack and, therefore, it is not necessary for them to work with the network interface in promiscuous mode.
- 61. Copyright © 2010 Pearson Education, Inc. Link for Digital signature explanation. http://www.developer.com/java/ent/arti cle.php/3092771/How-Digital- Signatures-Work-Digitally-Signing- Messages.htm