E Comm Security and EPS

Chapter 5
E-commerce Security and

Payment Systems
Copyright © 2014 Pearson Education, Inc. Publishing as

Prentice Hall
Cyberwar: MAD 2.0
 What is the difference between hacking
and cyberwar?
 Why has cyberwar become more
potentially devastating in the past
decade?
 Why has Google been the target of so
many cyberattacks?
 Is it possible to find a political solution to
MAD 2.0?
Slide 5-2
The E-commerce Security
Environment
 Overall size and losses of cybercrime unclear
 Reporting issues
 2012 survey: Average annualized cost of
cybercrime was $8.9 million/year
 Underground economy marketplace:
 Stolen information stored on underground economy
servers

Prentice Hall Slide 5-3
What Is Good E-commerce Security?
 To achieve highest degree of security
 New technologies
 Organizational policies and procedures
 Industry standards and government laws
 Other factors
 Time value of money
 Cost of security vs. potential loss
 Security often breaks at weakest link
Slide 5-4
The E-commerce Security Environment
Figure 5.1, Page 252
Slide 5-5
Table 5.3, Page 254
Overheads Between Security and
Other Values
 Ease of use
 The more security measures added, the more difficult a
site is to use, and the slower it becomes
 Public safety and criminal uses of the Internet
 Use of technology by criminals to plan crimes or
threaten nation-state
Slide 5-7
Security Threats in the
E-commerce Environment
 Three
key points of vulnerability in
e-commerce environment:
1. Client
2. Server
3. Communications pipeline (Internet
communications channels)
Slide 5-8
A Typical E-commerce Transaction

Vulnerable Points in an E-commerce Transaction

Most Common Security Threats in the
E-commerce Environment
 Malicious code (malware, exploits)
 Drive-by downloads
 Viruses
 Worms
 Ransomware
 Trojan horses
 Backdoors
 Bots, botnets
 Threats at both client and server levels

Most Common Security Threats (cont.)
 Potentially unwanted programs (PUPs)
 Browser parasites
 Adware
 Spyware
 Phishing
 Social engineering
 E-mail scams
 Spear-phishing
 Identity fraud/theft

 Hacking
 Hackers vs. crackers
 Types of hackers: White, black, grey hats
 Hacktivism
 Cybervandalism:
 Disrupting, defacing, destroying Web site
 Data breach
 Losing control over corporate information to
outsiders

 Credit card fraud/theft
 Spoofing and pharming
 Spam (junk) Web sites (link farms)
 Identity fraud/theft
 Denial of service (DoS) attack
 Hackers flood site with useless traffic to overwhelm
network
 Distributed denial of service (DDoS)
attack
 Sniffing
 Eavesdropping program that monitors information
traveling over a network
 Insider attacks
 Poorly designed server and client software
 Social network security issues
 Mobile platform security issues
 Vishing, smishing, madware
 Cloud security issues

 Spam is unsolicited email, instant messages, or social media messages.
These messages are fairly easy to spot and can be damaging if you open
or respond.
 Phishing is an email sent from an Internet criminal disguised as an
email from a legitimate, trustworthy source. The message is meant to
lure you into revealing sensitive or confidential information.
 Spear Phishing occurs when criminals obtain information about you
from websites or social networking sites, and customize a phishing
scheme to you.
 Spoofing describes a criminal who impersonates another individual or
organization, with the intent to gather personal or business information.
 Pharming is a malicious website that resembles a legitimate website,
used to gather usernames and passwords.
Think Your Smartphone Is Secure?
 What types of threats do smartphones face?

 Are there any particular vulnerabilities to
this type of device?
 What did Nicolas Seriot’s “Spyphone”
prove?
 Are apps more or less likely to be subject to
threats than traditional PC software
programs?

 Denial-of-service (DoS) attacks typically flood servers, systems or
networks with traffic in order to overwhelm the victim resources and
make it difficult or impossible for legitimate users to use them.
 While an attack that crashes a server can often be dealt with
successfully by simply rebooting the system, flooding attacks can be
more difficult to recover from.
 Degradation in network performance, especially when attempting to
open files stored on the network or accessing websites;
 Inability to reach a particular website;
 Difficulty in accessing any website; and
 A higher than usual volume of spam email.
DDoS
 An additional type of DoS attack is the Distributed Denial of
Service (DDoS) attack. A DDoS attack occurs when multiple
systems orchestrate a synchronized DoS attack to a single target.
The essential difference is that instead of being attacked from one
location, the target is attacked from many locations at once. The
distribution of hosts that defines a DDoS provide the attacker
multiple advantages:
 He can leverage the greater volume of machine to execute a
seriously disruptive attack
 The location of the attack is difficult to detect due to the random
distribution of attacking systems (often worldwide)
 It is more difficult to shut down multiple machines than one
 The true attacking party is very difficult to identify, as they are
disguised behind many (mostly compromised) systems
Technology Solutions
 Protecting Internet communications
 Encryption
 Securing channels of communication
 SSL, VPNs
 Protecting networks
 Firewalls
 Protecting servers and clients

Tools Available to Achieve Site Security

Encryption
 Encryption
 Transforms data into cipher text readable only by
sender and receiver
 Secures stored information and information
transmission
 Provides 4 of 6 key dimensions of e-commerce
security:
○ Message integrity
○ Nonrepudiation
○ Authentication
○ Confidentiality

Symmetric Key Encryption
 Sender and receiver use same digital key to encrypt
and decrypt message
 Requires different set of keys for each transaction
 Strength of encryption
 Length of binary key used to encrypt data
 Data Encryption Standard (DES)

 Advanced Encryption Standard (AES)
 Most widely used symmetric key encryption
 Uses 128-, 192-, and 256-bit encryption keys
 Other standards use keys with up to 2,048 bits

Public Key Encryption
 Uses two mathematically related digital keys
 Public key (widely disseminated)
 Private key (kept secret by owner)
 Both keys used to encrypt and decrypt message

 Once key used to encrypt message, same key
cannot be used to decrypt message
 Sender uses recipient’s public key to encrypt
message; recipient uses private key to decrypt it

Public Key Cryptography: A Simple Case

Public Key Encryption using Digital
Signatures and Hash Digests
 Hash function:
 Mathematical algorithm that produces fixed-length number called
message or hash digest
 Hash digest of message sent to recipient along with
message to verify integrity
 Hash digest and message encrypted with recipient’s
public key
 Entire cipher text then encrypted with recipient’s
private key—creating digital signature—for
authenticity, nonrepudiation

Public Key Cryptography with Digital Signatures

Digital Envelopes
 Address weaknesses of:
 Public key encryption
○ Computationally slow, decreased transmission speed,
increased processing time
 Symmetric key encryption
○ Insecure transmission lines
 Uses symmetric key encryption to

encrypt document
 Uses public key encryption to encrypt
and send symmetric key

Creating a Digital Envelope

Digital Certificates and
Public Key Infrastructure (PKI)
 Digital certificate includes:
 Name of subject/company
 Subject’s public key
 Digital certificate serial number
 Expiration date, issuance date
 Digital signature of CA
 Public Key Infrastructure (PKI):
 CAs and digital certificate procedures
 PGP

public-key infrastructure (PKI)?
 The comprehensive system required to provide
public-key encryption and digital signature services
is known as a public-key infrastructure.
 The purpose of a public-key infrastructure is to
manage keys and certificates.
 By managing keys and certificates through a PKI, an
organization establishes and maintains a trustworthy
networking environment.
 A PKI enables the use of encryption and digital
signature services across a wide variety of
applications.
Components of PKI
The PKI environment is made up of five components:
 Certification Authority (CA) -- serves as the root of trust that
authenticates the identity of individuals, computers and other
entities in the network.
 Registration Authority (RA) -- is certified by a root CA to issue
certificates for uses permitted by the CA. In a Microsoft PKI
environment, the RA is normally called a subordinate CA.
 Certificate Database -- saves certificate requests issued and
revoked certificates from the RA or CA.
 Certificate Store -- saves issued certificates and pending or
rejected certificate requests from the local computer.
 Key Archival Server -- saves encrypted private keys in a certificate
database for disaster recovery purposes in case the Certificate
Database is lost.
Hierarchy of CA
 Root CA: A Root CA is the topmost Certificate Authority (CA) in a
Certificate Authority (CA) hierarchy. Each Certificate Authority
(CA) hierarchy begins with the Root CA, and multiple CAs branch
from this Root CA in a parent-child relationship. All child CAs
must be certified by the corresponding parent CA back to the Root
CA. The Root CA is kept in a secure area and it is usually a stand-
alone offline CA (to make it topmost secure Certificate Authority
(CA). The root CA provides certificates for intermediate CAs. The
certificates can be revoked if they are compromised.
 Intermediate CAs: An intermediate Certificate Authority (CA) is a
CA that is subordinate to another CA (Root CA or another
intermediate CA) and issues certificates to other CAs in the CA
hierarchy. Intermediate CAs are usually stand-alone offline CAs
like root CAs.
 Issuing CAs: Issuing CAs are used to provide certificates to users,
computers, and other services. There can be multiple issuing CAs,
and one issuing CA can be used for generating computer
certificates and another can be used for generating user certificates.
Digital Certificates and Certification Authorities

Limits to Encryption Solutions
 Doesn’t protect storage of private key
 PKI not effective against insiders, employees
 Protection of private keys by individuals may be
haphazard
 No guarantee that verifying computer of
merchant is secure
 CAs are unregulated, self-selecting
organizations

SSL
 The SSL messages are sent in the following order:Client hello - The client
sends the server information including the highest version of SSL it supports
and a list of the cipher suites it supports. (TLS 1.0 is indicated as SSL 3.1.)
The cipher suite information includes cryptographic algorithms and key
sizes.
 Server hello - The server chooses the highest version of SSL and the best
cipher suite that both the client and server support and sends this information
to the client.
 Certificate - The server sends the client a certificate or a certificate chain. A
certificate chain typically begins with the server's public key certificate and
ends with the certificate authority's root certificate. This message is optional,
but is used whenever server authentication is required.
 Certificate request - If the server needs to authenticate the client, it sends
the client a certificate request. In Internet applications, this message is rarely
sent.
 Server key exchange - The server sends the client a server key exchange
message when the public key information sent in step 3 is not sufficient for
key exchange.
 Server hello done - The server tells the client
that it is finished with its initial negotiation
messages.
 Certificate - If the server requests a certificate
from the client in Message 4, the client sends
its certificate chain, just as the server did in
Message.
 Client key exchange - The client generates information used to create a key to
use for symmetric encryption. For RSA, the client then encrypts this key
information with the server's public key and sends it to the server.
 Certificate verify - This message is sent when a client presents a certificate as
described previously. Its purpose is to allow the server to complete the process
of authenticating the client. When this message is used, the client sends
information that it digitally signs using a cryptographic hash function. When
the server decrypts this information with the client's public key, the server is
able to authenticate the client.
 Change cipher spec - The client sends a message telling the server to change
to encrypted mode.
 Finished - The client tells the server that it is ready for secure data
communication to begin.
 Change cipher spec - The server sends a message telling the client to change
to encrypted mode.
 Finished - The server tells the client that it is
ready for secure data communication to begin.
This is the end of the SSL handshake.
 Encrypted data - The client and the server
communicate using the symmetric encryption
algorithm and the cryptographic hash function
negotiated in Messages 1 and 2, and using the
secret key that the client sent to the server in
Message 8.
 Close Messages - At the end of the connection,
each side will send a close_notify message to
inform the peer that the connection is closed
SET Protocol
 How SET works:
 Assume that a customer has a SET-enabled browser such as
Netscape or Microsoft's Internet Explorer and that the
transaction provider (bank, store, etc.) has a SET-enabled server.
 The customer opens a Mastercard or Visa bank account. Any
issuer of a credit card is some kind of bank.
 The customer receives a digital certificate. This electronic file
functions as a credit card for online purchases or other
transactions. It includes a public key with an expiration date. It
has been through a digital switch to the bank to ensure its
validity.
 Third-party merchants also receive certificates from the
bank. These certificates include the merchant's public key
and the bank's public key.
 The customer places an order over a Web page, by phone,
or some other means.
 The customer's browser receives and confirms from the
merchant's certificate that the merchant is valid.
 The browser sends the order information. This message is
encrypted with the merchant's public key, the payment
information, which is encrypted with the bank's public key
(which can't be read by the merchant), and information that
ensures the payment can only be used with this particular
order.
 The merchant verifies the customer by checking the
digital signature on the customer's certificate. This may be
done by referring the certificate to the bank or to a third-
party verifier.
 The merchant sends the order message along to the bank.
This includes the bank's public key, the customer's
payment information (which the merchant can't decode),
and the merchant's certificate.
 The bank verifies the merchant and the message. The bank
uses the digital signature on the certificate with the
message and verifies the payment part of the message.
 The bank digitally signs and sends authorization to the
merchant, who can then fill the order.
Securing Channels of Communication
 Secure Sockets Layer (SSL)/Transport
Layer Security (TLS)
 Establishes secure, negotiated client–server
session
 Virtual Private Network (VPN)
 Allows remote users to securely access internal
network via the Internet
 Wireless (Wi-Fi) networks
 WPA2

Secure Negotiated Sessions Using SSL/TLS

Protecting Networks
 Firewall
 Hardware or software
 Uses security policy to filter packets
 Two main methods:
○ Packet filters
○ Application gateways
 Proxy servers (proxies)

 Software servers that handle all communications
from or sent to the Internet
 Intrusion detection systems
 Intrusion prevention systems

Firewalls and Proxy Servers

Protecting Servers and Clients
 Operating system security enhancements
 Upgrades, patches
 Anti-virus software
 Easiest and least expensive way to prevent
threats to system integrity
 Requires daily updates

Management Policies, Business
Procedures, and Public Laws
 Worldwide, companies spend more than $65
billion on security hardware, software, services
 Managing risk includes:
 Technology
 Effective management policies
 Public laws and active enforcement

A Security Plan: Management Policies
 Risk assessment
 Security policy
 Implementation plan
 Security organization
 Access controls
 Authentication procedures, including biometrics
 Authorization policies, authorization management
systems
 Security audit

Developing an E-commerce Security Plan

The Role of Laws and Public Policy
 Laws that give authorities tools for identifying,
tracing, prosecuting cybercriminals:
 National Information Infrastructure Protection Act of 1996
 USA Patriot Act
 Homeland Security Act
 Private and private-public cooperation
 CERT Coordination Center
 US-CERT
 Government policies and controls on encryption
software
 OECD, G7/G8, Council of Europe, Wassener Arrangement

Types of Payment Systems
 Cash
 Most common form of payment
 Instantly convertible into other forms of value
 No float
 Checking transfer
 Second most common payment form in United States
 Credit card
 Credit card associations
 Issuing banks
 Processing centers

Types of Payment Systems (cont.)
 Stored value
 Funds deposited into account, from which funds
are paid out or withdrawn as needed
 Debit cards, gift certificates
 Peer-to-peer payment systems
 Accumulating balance
 Accounts that accumulate expenditures and to
which consumers make period payments
 Utility, phone, American Express accounts

Payment System Stakeholders
 Consumers
 Low-risk, low-cost, refutable, convenience, reliability
 Merchants
 Low-risk, low-cost, irrefutable, secure, reliable
 Financial intermediaries
 Secure, low-risk, maximizing profit
 Government regulators
 Security, trust, protecting participants and enforcing
reporting

E-commerce Payment Systems
 Credit cards
 42% of online payments in 2013 (United States)
 Debit cards
 29% online payments in 2013 (United States)
 Limitations of online credit card payment
 Security, merchant risk
 Cost
 Social equity

How an Online Credit Transaction Works

Alternative Online Payment Systems
 Online stored value systems:
 Based on value stored in a consumer’s bank,
checking, or credit card account
 Example: PayPal
 Other alternatives:
 Amazon Payments
 Paytm

Mobile Payment Systems
 Use of mobile phones as payment devices

established in Europe, Japan, South Korea
 Near field communication (NFC)
 Short-range (2”) wireless for sharing data between devices
 Expanding in United States

 Google Wallet
○ Mobile app designed to work with NFC chips
 PayPal
 Square

Digital Cash and Virtual Currencies
 Digital cash
 Based on algorithm that generates unique tokens
that can be used in “real” world
 Example: Bitcoin
 Virtual currencies
 Circulate within internal virtual world
 Example: Linden Dollars in Second Life,
Facebook Credits

Bitcoin
 What are some of the benefits of using a
digital currency?
 What are the risks involved to the user?
 What are the political and economic
repercussions of a digital currency?
 Have you or anyone you know ever used
Bitcoin?

Electronic Billing Presentment and
Payment (EBPP)
 Onlinepayment systems for monthly bills
 50% of all bill payments
 Two competing EBPP business models:
 Biller-direct (dominant model)
 Consolidator
 Both models are supported by EBPP

infrastructure providers


E Comm Security and EPS

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

E Comm Security and EPS

Transféré par

Droits d'auteur :

Formats disponibles

Chapter 5

E-commerce Security and

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.1, Page 252

Figure 5.2, Page 256

Figure 5.3, Page 257

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

 Cloud security issues

 What types of threats do smartphones face?

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.5, Page 276

Copyright © 2014 Pearson Education, Inc. Publishing as

 Data Encryption Standard (DES)

 Other standards use keys with up to 2,048 bits

Copyright © 2014 Pearson Education, Inc. Publishing as

 Both keys used to encrypt and decrypt message

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.6, Page 279

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.7, Page 281

 Uses symmetric key encryption to

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.8, Page 282

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.9, Page 283

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.10, Page 286

 Proxy servers (proxies)

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.11, Page 289

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.12, Page 291

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Figure 5.15, Page 302

Copyright © 2014 Pearson Education, Inc. Publishing as

 Use of mobile phones as payment devices

 Expanding in United States

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

Copyright © 2014 Pearson Education, Inc. Publishing as

 Both models are supported by EBPP

Copyright © 2014 Pearson Education, Inc. Publishing as

Vous aimerez peut-être aussi