Lecture # 19SECURITY
THE E-COMMERCE SECURITY ENVIRONMENT:THE SCOPE OF THE PROBLEMOverall size of cybercrime unclear; amount of losses significa...
THE DIFFERENT DIMENSIONS OF E-COMMERCESECURITY• Integrity– The ability to ensure that information being displayed on a web...
SECURITY THREATS IN THE E-COMMERCEENVIRONMENTThree key points of vulnerability:– Client– Server– Communications channel
A TYPICAL E-COMMERCE TRANSACTION
MALICIOUS CODE• Viruses:– Have ability to replicate and spread to other files; most also deliver   a “payload” of some sor...
UNWANTED PROGRAMSInstalled without the user’s informed consent– Browser parasites: Can monitor and change  settings of a u...
PHISHING AND IDENTITY THEFTAny deceptive, online attempt by a third party  to obtain confidential information for financia...
HACKING AND CYBERVANDALISM• Hacker: Individual who intends to gain   unauthorized access to computer systems• Cracker: Hac...
CREDIT CARD FRAUDFear that credit card information will be stolen  deters online purchases• Hackers target credit card fil...
SPOOFING (PHARMING) AND SPAM (JUNK) WEBSITESSpoofing (Pharming)– Misrepresenting oneself by using fake e-mail  addresses o...
DOS AND DDOS ATTACKSDenial of service (DoS) attack– Hackers flood Web site with useless traffic to  inundate and overwhelm...
OTHER SECURITY THREATSSniffing: Type of eavesdropping program that   monitors information traveling over a   network; enab...
TECHNOLOGY SOLUTIONS• Protecting Internet communications  (encryption)• Securing channels of communication  (SSL, S-HTTP, ...
PROTECTING INTERNET COMMUNICATIONS:ENCRYPTIONEncryption:– Process of transforming plain text or data into cipher   text th...
Important Notes
Important Notes
Upcoming SlideShare
Loading in …5
×

Important Notes

672
-1

Published on

Published in: Education, Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
672
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
6
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Important Notes

  1. 1. Lecture # 19SECURITY
  2. 2. THE E-COMMERCE SECURITY ENVIRONMENT:THE SCOPE OF THE PROBLEMOverall size of cybercrime unclear; amount of losses significant but stable;individuals face new risks of fraud that may involve substantial uninsuredlosses– Symantec: Cybercrime on the rise from 2006– Internet Crime Complaint Center (IC3): Logged 1 000 000+ consumercomplaints about alleged online fraud or cyber crime and referred 460,000+complaints to law enforcement agencies– 2007 Computer Security Institute (CSI) survey: 46% detected security breach;91% suffered financial loss as a result. The average annual loss reported in thisyear’s survey shot up to $350,424 from $168,000 the previous year.– Underground economy marketplace that offers sales of stolen informationgrowing.
  3. 3. THE DIFFERENT DIMENSIONS OF E-COMMERCESECURITY• Integrity– The ability to ensure that information being displayed on a web site or transmitted orreceived over the internet has not been altered in any way by an unauthorized party• Non repudiation– The ability to ensure that e-commerce participants do not deny (i.e. repudiate) their onlineactions• Authenticity– The ability to identify the identity of a person or entity with whom you are dealing in theinternet• Confidentiality– The ability to ensure that messages and data are available only to those who are authorizedto view them• Privacy– The ability to control the use of information about oneself• Availability– The ability to ensure that an e-commerce site continues top function as intended
  4. 4. SECURITY THREATS IN THE E-COMMERCEENVIRONMENTThree key points of vulnerability:– Client– Server– Communications channel
  5. 5. A TYPICAL E-COMMERCE TRANSACTION
  6. 6. MALICIOUS CODE• Viruses:– Have ability to replicate and spread to other files; most also deliver a “payload” of some sort (destructive or benign); include macro viruses, file-infecting viruses, and script viruses• Worms:– Designed to spread from computer to computer• Trojan horse:– Appears to be benign, but then does something other than expected• Bots:– Can be covertly installed on computer; responds to external commands sent by the attacker
  7. 7. UNWANTED PROGRAMSInstalled without the user’s informed consent– Browser parasites: Can monitor and change settings of a user’s browser.– Adware: Calls for unwanted pop-up ads– Spyware: Can be used to obtain information, such as a user’s keystrokes, e- mail, IMs, etc.
  8. 8. PHISHING AND IDENTITY THEFTAny deceptive, online attempt by a third party to obtain confidential information for financial gain– Most popular type: e-mail scam letter– One of fastest growing forms of e-commerce crime
  9. 9. HACKING AND CYBERVANDALISM• Hacker: Individual who intends to gain unauthorized access to computer systems• Cracker: Hacker with criminal intent (two terms often used interchangeably)• Cyber vandalism: Intentionally disrupting, defacing or destroying a Web site• Types of hackers include:– White hats– Black hats– Grey hats
  10. 10. CREDIT CARD FRAUDFear that credit card information will be stolen deters online purchases• Hackers target credit card files and other customer information files on merchant servers; use stolen data to establish credit under false identity• One solution: New identity verification mechanisms
  11. 11. SPOOFING (PHARMING) AND SPAM (JUNK) WEBSITESSpoofing (Pharming)– Misrepresenting oneself by using fake e-mail addresses or masquerading as someone else– Threatens integrity of site; authenticitySpam (Junk) Web sites– Use domain names similar to legitimate one, redirect traffic to spammer redirection domains
  12. 12. DOS AND DDOS ATTACKSDenial of service (DoS) attack– Hackers flood Web site with useless traffic to inundate and overwhelm network• Distributed denial of service (DDoS) attack– Hackers use numerous computers to attack target network from numerous launch points
  13. 13. OTHER SECURITY THREATSSniffing: Type of eavesdropping program that monitors information traveling over a network; enables hackers to steal proprietary information from anywhere on a network• Insider jobs: Single largest financial threat• Poorly designed server and client software: Increase in complexity of software programs has contributed to increase is vulnerabilities that hackers can exploit
  14. 14. TECHNOLOGY SOLUTIONS• Protecting Internet communications (encryption)• Securing channels of communication (SSL, S-HTTP, VPNs)• Protecting networks (firewalls)• Protecting servers and clients
  15. 15. PROTECTING INTERNET COMMUNICATIONS:ENCRYPTIONEncryption:– Process of transforming plain text or data into cipher text that cannot be read by anyone other than the sender and receiver• Purpose:– Secure stored information and information transmission• Provides:– Message integrity– Nonrepudiation– Authentication– Confidentiality
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×