Webpay - Payment Gateway Business Plan

Editor's Notes

• #13: 1. Satisfactory Experience to customers: We offer our customers a good experience in making the payment with confidence by using credit card, debit card, electronic check and allow them to buy products from all over the world. 2. Multiple payment optionsThis feature will improves business efficiency of handling many tasks in a wider range and fulfill the needs of customers. It will make clients able to pay your products or services through their selected payment gateways like PayPal, Authorize.net, Google Checkout and various other online payment gateways. 3. Fraud screening features: The Payment gateway enables your business to track misuse of credit card or debit card and screen fraud purchases. It will minimize such malpractices to a great extent that it will protect you from suspicious transactions and larger charge back costs. Further, this will alert merchants on any fraudulent representation and prevent it for about 80 to 90%. 4. Triggered Payments Triggered payments allow for the storage of credit card payments for recurring payments. This is useful if you plan to offer lay by or you have regular customers that use your web store. 5. Payment Modes Start and end payments on the same page. Accept all major debit and credit cards, UPI, 50+ net banking banks and popular wallets. 6. User-friendly and speedy in processing Last but not the least, payment gateway is user friendly and speedy in processing. As this will save customer’s time and make business to operate more easier. This will attract more visitors to have a glance at your business. 7. Built for Developers Robust, clean, developer-friendly Payment Gateway that lets you focus on building great products instead of worrying about integration.
• #14: 1. Satisfactory Experience to customers: We offer our customers a good experience in making the payment with confidence by using credit card, debit card, electronic check and allow them to buy products from all over the world. 2. Multiple payment optionsThis feature will improves business efficiency of handling many tasks in a wider range and fulfill the needs of customers. It will make clients able to pay your products or services through their selected payment gateways like PayPal, Authorize.net, Google Checkout and various other online payment gateways. 3. Fraud screening features: The Payment gateway enables your business to track misuse of credit card or debit card and screen fraud purchases. It will minimize such malpractices to a great extent that it will protect you from suspicious transactions and larger charge back costs. Further, this will alert merchants on any fraudulent representation and prevent it for about 80 to 90%. 4. Triggered Payments Triggered payments allow for the storage of credit card payments for recurring payments. This is useful if you plan to offer lay by or you have regular customers that use your web store. 5. Payment Modes Start and end payments on the same page. Accept all major debit and credit cards, UPI, 50+ net banking banks and popular wallets. 6. User-friendly and speedy in processing Last but not the least, payment gateway is user friendly and speedy in processing. As this will save customer’s time and make business to operate more easier. This will attract more visitors to have a glance at your business. 7. Built for Developers Robust, clean, developer-friendly Payment Gateway that lets you focus on building great products instead of worrying about integration.
• #101: By Abdul Mughni Ansari 15-I-102 Hemal Doshi 15-I-112 Harshad Kadu 15-I-119 Suyog Kore 15-I-122 Anjani Kumar Mishra 15-I-128 Priyanka Phatak 15-I-134 Mushfique Shaikh 15-I-140 Jitesh Soni 15-I-148 Amol Virbhache 15-I-151 Harshal Desai 14-I-111
• #113: Over the last couple of years, mobile payment systems, as the following, have been compromised: Google Wallet has had it’s fair share of hacks in the past, such as the 2012 hack that exposed user’s PINs. The Starbucks app  was hacked in May 2015 which automatically withdraw funds from user’s bank, credit, or PayPal accounts. CurrentC was jeopardized in 2014 after the email addresses of pilot participants. Slate discovered in early 2015 that the accounts of users on the popular mobile-payment solution Venmo had been hacked, which resulted in their accounts getting drained. Fraudsters were able to hack into Apple Pay accounts when users were first inputting their credit card information. LoopPay, the core of Samsung’s mobile payment system, was broken into in 2015 by state-sponsored Chinese hackers. While no information was stolen, it’s believed that the group left backdoors so that they could reenter the system. To put this concern into perspective, recent research from Arxan determined that among the top paid and free mobile applications: 100% of the top 100 paid apps on the Google Android platform had been hacked 56% of the top 100 paid apps for Apple iOS had been hacked 73% of popular free apps on Android had been hacked 53% of popular free apps on Apple iOS had been hacked
• #114: Using Code from Other Developers It takes a lot of time to develop an app from the ground up, but there's no need to do so when so much free code exists to build on. Some hackers create code in the hopes that app developers pick it up to use in their apps. This gives hackers access to any information they want after the app’s release. There's nothing wrong with building upon the ideas of others, but you have to do your research. Make sure that if you use code from a third-party source, you can trust it's not going to cause security issues. Read the code line by line to look for phishing scams and only use verified and trusted sources for code. Not Planning for Data Caching Vulnerabilities Mobile devices are fundamentally different from standard laptops and desktops in that they store short-term information as long as possible (caching) to increase speed. This makes mobile devices more susceptible to security breaches because hackers can access cached information easily. To avoid the problem, you can require a password to use an app. Of course, app users often find passwords inconvenient, which can hurt the popularity of your app. You can try another solution to data caching vulnerabilities by programming the cache to automatically be wiped every time the mobile device reboots. Foregoing Thorough Security Testing As the app developer, you’re the last line of defense. If you don’t ensure your app is secure, you put all of your app's users at risk. That means you should never rush to release an app before you have properly tested it. Test every inlet for security issues, including the camera, GPS, sensors, and even the platform itself. No app is safe from the attacks of viruses and malware. During testing, avoid allowing users to see crash and debug logs. These are often the first places hackers look for app vulnerabilities. As an app developer, you can disable the NSLog statements on iOS. This action increases the speed of the app, too, which your users will appreciate. The Android debug log is typically cleared when a device is rebooted, but an app is vulnerable until that happens. Forgetting to Plan for Physical Security Breaches There's not much app developers can do to prevent mobile devices from being stolen or lost, but implementing a local session timeout code does help. Basically, users must periodically enter a password to get into an app. Instead of happening daily, it could be something like entering a password once a week or every five times they use an app. Sometimes, mobile devices have software that remembers passwords, but the local session timeout prevents this. Patching Your App Too Slowly You're not done after you launch your app. Hackers work fast. They look for apps that don't release security updates often, and then exploit those security holes. You need to revisit the app often to perform security updates. However, patches can regularly take time to reach users. For instance, Apple's approval process can take as long as a week. Plus, all mobile device users have to accept and download the patch. If you don't stay on top of new security updates, patches will take too long to reach users, putting their information at risk. There’s no margin for error when apps deal with things like customer credit cards and personal information. The repercussions of a security breach are catastrophic to an app developer. Don’t get caught unaware and unprepared. Make the necessary precautions to protect your app and its users. Securing Outside the Box It’s critically important to consider all of the various techniques for securing an app through intelligent development decisions. For enterprises developing and deploying apps internally to their employees, there are additional tools to consider. An enterprise mobility management (EMM) solution provides protections typically not addressed through direct app development. These protections start with the basic and most important, detection and remediation if an iOS device is jailbroken or an Android device is rooted. If all the built-in security of the mobile operating system has been removed, no app specific protections are going to keep the data safe for long, as all the above techniques build upon the inherent mobile OS security features. Beyond jailbreak and root security, an EMM solution can provide enterprise authentication requirements before launching an app and the ability to apply various security policies to prevent data breach. For example, the app and the device may be secure, but what about the data transmissions? Can those transmissions only happen over a secure channel? Will you allow the app to transmit if connected to an untrusted WiFi network? These and many other vulnerabilities can be addressed by the inclusion of an EMM solution in the enterprise. The combination of development strategies combined with EMM is the most comprehensive way to insure that devices, apps, and the critical data they contain stay safe in an unsafe digital world.
• #115: Wallet also comes with 24/7 fraud protection and monitoring. If you lose your phone, you can login to your Google Wallet account on any browser to instantly disable your lost or stolen device. You also have to enter a PIN to use Google Wallet, as you would with a debit card. Mobile malware often taps vulnerabilities or bugs in the design and coding of the mobile applications they target. Recent research from Kindsight reported by Infosecurity shows that malicious code is infecting more than 11.6 million mobile devices at any given time, and the number of mobile malware samples is growing at a rapid clip, increasing by twentyfold in 2013. Even before a vulnerability is exploited, attackers can obtain a public copy of an application and reverse engineer it. Popular applications are repackaged into “rogue apps” containing malicious code and are posted on third-party app stores to lure and trick unsuspecting users to install them and compromise their devices. Enterprises should look for tools to aid their developers to detect and close security vulnerabilities and then harden their applications against reverse engineering and tampering. However, “consumer apps” still represent a threat as they may not undergo the appropriate hardening process; and if rogue applications, malware and enterprise apps share the same device, the threat is tangible. Secure the Device: Detecting Compromised and Vulnerable Run-Time Environment As secure as an application is, its security relies on the underlying device’s security. Jailbroken or rooted devices or the presence of rogue applications can represent an execution risk that may be allowed for certain enterprise apps but not for others. Enterprises should look into ways to dynamically gauge the security of the underlying device. First, the mobile app sandbox, which is prevalent in modern mobile operating system design, must be intact. Rooting or jailbreaking the device breaks the underlying security model, and it is highly recommended to restrict these devices from accessing enterprise data. Furthermore, jailbreak technology is evolving rapidly to evade detection; coping with these mechanisms is essential to keeping up with these threats. Mobile malware doesn’t always rely on the device being jailbroken, however. Excessive use of permissions to the mobile applications — which are granted by the user, often by default — can provide malware and rogue applications access to basic services (e.g., SMS) used to facilitate fraudulent activities. Enterprises should consider up-to-date intelligence sources and application reputation services to track the tidal wave of applications — and their associated risk — as they enter mobile app stores on a daily basis. Using this data, application capabilities could be enabled or disabled based on the device risk profile. If I use an app to log into another service, what assurance is there that they aren't storing my password in cleartext?  It is easy to make mistakes such as storing user data (passwords/usernames) incorrectly on the device, in the vast majority of cases credentials get stored either unencrypted or have been encoded using methods such as base64 encoding (or others) and are rather trivial to reverse,” says Andy Swift, mobile security researcher from penetration testing firm Hut3. Don't allow repeat requests. Attackers can replay intercepted requests. The resulting impact can range from being merely annoying (as in the case of a repeat Tweet) to having dire consequences (for example, when a request to transfer money is re-sent). Developers can prevent repeat requests by using a NONCE (number used once.) The client generates a random number for each request. The server keeps track of these numbers to ensure that the requests are true and not being re-executed. If a repeat NONCE occurs, then the server knows that the request is invalid. The list of NONCEs stored on the server can be minimized by using a timestamp, as explained in number five. Don't allow modified requests. Rather than repeating a request, an attacker may choose to modify it. For example, the attacker may transfer money to a different account altogether. This can be prevented by using a shared secret or a cryptographic keypair. Creating an HMAC of the request and sending it to the server with the request allows the server to confirm that the request has not been modified.