04-1 E-commerce Security slides


Published on

Published in: Education
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

04-1 E-commerce Security slides

  1. 1. e-commerce business. technology. society. eighth edition Kenneth C. Laudon Carol Guercio Traver Copyright © 2012 Pearson Education Chapter 4 E-commerce Security and Payment SystemsCopyright © 2012 Pearson Education 1
  2. 2. Cyberwar: Mutually Assured Destruction (MAD) Class Discussion What is the difference between hacking and cyberwar? Cyberwar is much more serious treat to infrastructure of entire nation Why has cyberwar become more potentially devastating in the past decade? Because highly developed nations has relied more on the Internet for business, government, and industrial and utility controls What percentage of computers have been compromised by stealth malware programs? 10% Will a political solution to MAD 2.0 be effective enough? Probably not Copyright © 2012 Pearson Education Slide 4-3Computer-generated Simulation of a DDoS Attack Copyright © 2012 Pearson Education Slide 4-4 2
  3. 3. Learning Objectives Understand the scope of e-commerce crime and security problems Describe the key dimensions of e-commerce security Understand the tension between security and other values Identify the key security threats in the e-commerce environment Describe how technology helps protect the security of messages sent over the Internet Identify the tools used to establish secure Internet communications channels and protect networks, servers, and clients Appreciate the importance of policies, procedures, and laws in creating securityCopyright © 2012 Pearson Education Slide 4-5Copyright © 2012 Pearson Education Slide 4-6 3
  4. 4. The E-commerce Security Environment Overall size and losses of cybercrime unclear Reporting issues 2011 CSI survey: 46% of respondent firms detected breach in last year Underground economy marketplace: Stolen information stored on underground economy servers Copyright © 2012 Pearson Education Slide 4-7Types ofAttacksAgainstComputerSystems(Cybercrime)Figure 4.1, Page 246SOURCE: Based on data fromComputer Security Institute,2011Copyright © 2012 Pearson Education Slide 4-8 4
  5. 5. Copyright © 2012 Pearson Education Slide 4-9 What Is Good E-commerce Security? To achieve highest degree of security New technologies Organizational policies and procedures Industry standards and government laws Other factors Time value of money Cost of security vs. potential loss Security often breaks at weakest link Copyright © 2012 Pearson Education Slide 4-10 5
  6. 6. The E-commerce Security EnvironmentFigure 4.2, Page 249Copyright © 2012 Pearson Education Slide 4-11 Dimensions of E-commerce Security Integrity: ability to ensure that information being displayed on a Web site or transmitted/received over the Internet has not been altered in any way by an unauthorized party Nonrepudiation: ability to ensure that e-commerce participants do not deny (repudiate) online actions Authenticity: ability to identify the identity of a person or entity with whom you are dealing on the Internet Confidentiality: ability to ensure that messages and data are available only to those authorized to view them Privacy: ability to control use of information a customer provides about himself or herself to merchant Availability: ability to ensure that an e-commerce site continues to function as intendedCopyright © 2012 Pearson Education Slide 4-12 6
  7. 7. Table 4.3, Page 250Copyright © 2012 Pearson Education Slide 4-13 The Tension Between Security and Other Values Security vs. Ease of use: The more security measures added, the more difficult a site is to use, and the slower it becomes Too much security can harm profitability, while not enough security can put you out of business Public safety and criminal uses of the Internet Use of technology by criminals to plan crimes or threaten nation-state The Internet is both anonymous and pervasive, an ideal communication tool for criminal and terrorist groupsCopyright © 2012 Pearson Education Slide 4-14 7
  8. 8. Security Threats in the E-commerce Environment Three key points of vulnerability in e-commerce environment: 1. Client 2. Server 3. Communications pipeline (Internet communications channels)Copyright © 2012 Pearson Education Slide 4-15 A Typical E-commerce TransactionFigure 4.3, Page 253Copyright © 2012 Pearson Education Slide 4-16 8
  9. 9. Vulnerable Points in an E-commerce TransactionFigure 4.4, Page 254Copyright © 2012 Pearson Education Slide 4-17 Most Common Security Threats in the E-commerce Environment Malicious code Viruses Worms Trojan horses Bots, botnets Unwanted programs Browser parasites Adware SpywareCopyright © 2012 Pearson Education Slide 4-18 9
  10. 10. Malicious Code Viruses: Replicate and spread to other files; most deliver “payload” (destructive or benign) Macro viruses, file-infecting viruses, script viruses Worms: Designed to spread from computer to computer Can replicate without being executed by a user or program like virus Trojan horse: Appears benign, but does something other than expected Bots: Covertly installed on computer; respond to external commands sent by attacker to create a network of compromised computers for sending spam, generating a DDoS attack, and stealing info from computersCopyright © 2012 Pearson Education Slide 4-19Copyright © 2012 Pearson Education Slide 4-20 10
  11. 11. Copyright © 2012 Pearson Education Slide 4-21 Unwanted Programs Installed without user’s informed consent Browser parasites Can monitor and change settings of a user’s browser Adware Calls for unwanted pop-up ads Spyware Can be used to obtain information, such as a user’s keystrokes, e-mail, IMs, etc.Copyright © 2012 Pearson Education Slide 4-22 11
  12. 12. Most Common Security Threats (cont.) Social engineering Phishing Deceptive online attempt to obtain confidential information E-mail scams Spoofing legitimate Web sites Use of information to commit fraudulent acts (access checking accounts), steal identityCopyright © 2012 Pearson Education Slide 4-23 Phishing Mail ExampleCopyright © 2012 Pearson Education Slide 4-24 12
  13. 13. Copyright © 2012 Pearson Education Slide 4-25 Most Common Security Threats (cont.) Hacking Hackers: Individual who intends to gain unauthorized access to computer systems Crackers: Hacker with criminal intent Types of hackers: White hats – hired by corporate to find weaknesses in the firm’s computer system Black hats – hackers with intention of causing harm Grey hats – hackers breaking in and revealing system flaws without disrupting site or attempting to profit from their finds. Cybervandalism: Intentionally disrupting, defacing, destroying Web site Data breach When organizations lose control over corporate information to outsidersCopyright © 2012 Pearson Education Slide 4-26 13
  14. 14. Credit Card Fraud Fear of stolen credit card information deters online purchases US’s federal law limits liability of individuals to $50 for a stolen credit card Hackers target credit card files and other customer information files on merchant servers; use stolen data to establish credit under false identity Online companies at higher risk than offline due to difficulty of guarenteeing true identity of customers “E-Sign” law giving digital signatures same authority as hand-written ones applies only to large corporations, but not to B2C e-commerceCopyright © 2012 Pearson Education Slide 4-28Spoofing (Pharming) and Spam (Junk) Web Sites Spoofing (Pharming) Misrepresenting oneself by using fake e-mail addresses or masquerading as someone else Spoofing a Web site is called “pharming,” redirecting a Web link to another IP address different from the real one Threatens integrity (steal business from true site, or alter orders and send to true site), and authenticity (difficult to distinguish between true and fake Web address) Carried out by hacking local DNS servers Spam (Junk) Web sites Collection of advertisements for other sites, some of which containing malicious code Appears on search results, hiding their identities by using domain names similar to legitimate ones, and redirecting traffic to spammer domains, e.g., topsearch10.comCopyright © 2012 Pearson Education Slide 4-29 14
  15. 15. DoS and DDoS Attacks Denial of service (DoS) attack Hackers flood Web site with useless traffic to inundate and overwhelm network Use of bot networks built from hundreds of compromised workstations Distributed denial of service (DDoS) attack Hackers use multiple computers to attack target network from numerous launch points Microsoft and Yahoo have experienced such attacksCopyright © 2012 Pearson Education Slide 4-31 Denial of ServicePing Flooding Attacker sends a flood of pings to the intended victim The ping packets will saturate the victim’s bandwidth Internet Attacking System(s)SOURCE: PETER SHIPLEY Victim SystemCopyright © 2012 Pearson Education Slide 4-32 15
  16. 16. Denial of Service SMURF ATTACK Uses a ping packet with two extra twist Attacker chooses an unwitting victim Spoofs the source address Sends request to network in broadcast mode ICMP = Internet Control Message Protocol INTERNET 1 SYN PERPETRATOR VICTIM 10,000 SYN/ACKs -- VICTIM IS DEAD INNOCENT REFLECTOR SITES BANDWIDTH MULTIPLICATION: A T1 (1.54 Mbps) can easily yield 100 MBbps of attack ICMP echo (spoofed source address of victim) sent to IP broadcast address ICMP echo reply Copyright © 2012 Pearson Education SOURCE: 4-33 Slide CISCO DDoS Attack IllustratedHacker 1 Hacker scans Unsecured Computers Internet for unsecured systems that can be compromised InternetScanningProgram Copyright © 2012 Pearson Education Slide 4-34 16
  17. 17. DDoS Attack IllustratedHacker Zombies 2 Hacker secretly installs zombie agent programs, Internet turning unsecured computers into zombies Copyright © 2012 Pearson Education Slide 4-35 DDoS Attack IllustratedHacker Zombies Master Server 3 Hacker selects Internet a Master Server to send commands to the zombies Copyright © 2012 Pearson Education Slide 4-36 17
  18. 18. DDoS Attack IllustratedHacker Zombies Master Server 4 Using client Internet program, hacker sends commands to Master Server to launch zombie Targeted attack against a System targeted system Copyright © 2012 Pearson Education Slide 4-37 DDoS Attack IllustratedHacker Zombies Master Server 5 Master Server Internet sends signal to zombies to launch attack on targeted Targeted system System Copyright © 2012 Pearson Education Slide 4-38 18
  19. 19. DDoS Attack IllustratedHacker Zombies Master Server 6 Targeted system is overwhelmed by bogus requests that shut it Internet down for legitimate users Targeted Request Denied System User Copyright © 2012 Pearson Education Slide 4-39 Most Common Security Threats (cont.) Sniffing Eavesdropping program that monitors information traveling over a network Insider jobs: Single largest financial threat Poorly designed server and client software Due to increase in complexity and size of OS, application software, and browsers Social network security Social engineering attacks tempting visitors to FB pages to click on “bad-behavior” links Mobile platform threats Same risks as any Internet device Malware, botnets, vishing/smishing [discuss on textbook] Copyright © 2012 Pearson Education Slide 4-40 19
  20. 20. Technology Solutions Protecting Internet communications Encryption Securing channels of communication SSL, S-HTTP, VPNs Protecting networks Firewalls Protecting servers and clients Copyright © 2012 Pearson Education Slide 4-42Tools Available toAchieve SiteSecurityFigure 4.7, Page 270Copyright © 2012 Pearson Education Slide 4-43 20
  21. 21. Encryption Encryption Transforms plain text data into cipher text readable only by sender and receiver Purpose: Secures stored information and information transmission Provides 4 of 6 key dimensions of e-commerce security: Message integrity – assurance that message hasn’t been altered Nonrepudiation – prevents user from denying sending the message Authentication – verification of identity of person (computer) sending the msg Confidentiality – assurance that msg. was not read by othersCopyright © 2012 Pearson Education Slide 4-44 Symmetric Key Encryption Also known as secret key encryption Sender and receiver use same digital key to encrypt and decrypt message Requires different set of keys for each transaction Strength of encryption Length of binary key used to encrypt data Advanced Encryption Standard (AES) Most widely used symmetric key encryption Uses 128-, 192-, and 256-bit encryption keys Other standards use keys with up to 2,048 bitsCopyright © 2012 Pearson Education Slide 4-45 21
  22. 22. Symmetric Encryption and Decryption© 2004 D. A. Menascé. AllPearson Education Copyright © 2012 Rights Reserved. Slide 4-46 Public Key Encryption Solves symmetric key encryption problem of having to exchange secret key Uses two mathematically related digital keys Public key (widely disseminated) Private key (kept secret by owner) Both keys used to encrypt and decrypt message Once key used to encrypt message, same key cannot be used to decrypt message E.g., Sender uses recipient’s public key to encrypt message; recipient uses private key to decrypt it Copyright © 2012 Pearson Education Slide 4-47 22
  23. 23. Public Key Encryption and Decryption© 2004 D. A. Menascé. AllPearson Education Copyright © 2012 Rights Reserved. Slide 4-48 Public Key Cryptography: A Simple Case Figure 4.8, Page 276 Copyright © 2012 Pearson Education Slide 4-49 23
  24. 24. Public Key Encryption using Digital Signatures and Hash Digests Public key encryption provides confidentiality, but not authentication, integrity, and non-repudiation Hash function: Mathematical algorithm that produces fixed-length number called message or hash digest Hash digest of message sent to recipient along with message to verify integrity Hash digest and message encrypted with recipient’s public key Entire cipher text then encrypted with sender’s private key—creating digital signature—for authenticity, non- repudiation Copyright © 2012 Pearson Education Slide 4-50 Message Digest Message Message Digest 101…1010 Function Small Large (e.g., 128 bits)© 2004 D. A. Menascé. AllPearson Education Copyright © 2012 Rights Reserved. Slide 4-51 24
  25. 25. Message Digest A Digest A Message Digest Function B Digest B If A =B => Digest A = Digest B© 2004 D. A. Menascé. AllPearson Education Copyright © 2012 Rights Reserved. Slide 4-52 Message Digest Message ? Digest Digest A Function Extremely hard to get A from Digest A!© 2004 D. A. Menascé. AllPearson Education Copyright © 2012 Rights Reserved. Slide 4-53 25
  26. 26. Public Key Cryptography with Digital SignaturesFigure 4.9, Page 278Copyright © 2012 Pearson Education Slide 4-54 Digital Envelopes Address weaknesses of: Public key encryption Computationally slow, decreased transmission speed, increased processing time Symmetric key encryption Computationally faster, but less secure due to insecure transmission lines Uses more efficient symmetric key encryption to encrypt document Uses public key encryption to encrypt symmetric key and send the encrypted key (digital envelope) and encrypted document to the recipientCopyright © 2012 Pearson Education Slide 4-55 26
  27. 27. Creating a Digital EnvelopeFigure 4.10, Page 279Copyright © 2012 Pearson Education Slide 4-56 Digital Certificates and Public Key Infrastructure (PKI) Still missing a way to verify identity of Web sites By using digital document issued by a trusted third party called certificate authority (CA) Digital certificate includes: Name of subject/company Subject’s public key Digital certificate serial number Expiration date, issuance date Digital signature of CA Public Key Infrastructure (PKI): CAs and digital certificate procedures that are accepted by all parties Pretty Good Privacy (PGP) – a widely used e-mail public key encryption software [go to pgpi.org to download it]Copyright © 2012 Pearson Education Slide 4-57 27
  28. 28. Digital Certificates and Certification AuthoritiesFigure 4.11, Page 280Copyright © 2012 Pearson Education Slide 4-58 Limits to Encryption Solutions PKI mainly protect messages in transit Doesn’t protect storage of private key PKI not effective against insiders, employees Protection of private keys by individuals may be haphazard No guarantee that verifying computer of merchant is secure CAs are unregulated, self-selecting organizationsCopyright © 2012 Pearson Education Slide 4-59 28
  29. 29. Securing Channels of Communication Secure Sockets Layer (SSL): Establishes a secure, negotiated client-server session in which URL of requested document, along with contents, is encrypted Designed to establish a secure connection between two computers Virtual Private Network (VPN): Allows remote users to securely access internal network via the Internet, using Point-to-Point Tunneling Protocol (PPTP)Copyright © 2012 Pearson Education Slide 4-61 Secure Negotiated Sessions Using SSLFigure 4.12, Page 285Copyright © 2012 Pearson Education Slide 4-62 29
  30. 30. Protecting Networks Firewall Hardware or software that filters packets (prevents some packets from entering the network) by using security policy Two main methods: Packet filters – looks inside data packets to decide whether they are destined for a prohibited port or originate from a prohibited IP address Application gateways – filters communications based on the application being requested, rather than the source or destination of the message Application gateways provide greater security than packet filters, but can compromise system performanceCopyright © 2012 Pearson Education Slide 4-63 Protecting Networks Proxy servers (proxies) Software servers that handle all communications originating from or being sent to the Internet Initially for limiting access of internal clients to external Internet servers Can be used to restrict access to certain types of sites, such as porno, auction, or stock-trading sites, or to cache frequently-accessed Web pages to reduce download timesCopyright © 2012 Pearson Education Slide 4-64 30
  31. 31. Firewalls and Proxy ServersFigure 4.13, Page 288Copyright © 2012 Pearson Education Slide 4-65 Protecting Servers and Clients Operating system security enhancements Upgrades, patches Anti-virus software: Easiest and least expensive way to prevent threats to system integrity Requires daily updatesCopyright © 2012 Pearson Education Slide 4-66 31
  32. 32. Management Policies, Business Procedures, and Public Laws U.S. firms and organizations spend 14% of IT budget on security hardware, software, services ($35 billion in 2010) Managing risk includes Technology a foundation of security Effective management policies also required Public laws and active enforcementCopyright © 2012 Pearson Education Slide 4-67 A Security Plan: Management Policies Risk assessment: assessment of risks and points of vulnerability Develop security policy: set of statements prioritizing information risks, identifying acceptable risk targets, and identifying mechanisms for achieving targets Develop implementation plan Create security organization Administers access controls Authentication procedures, including biometrics Authorization policies, authorization management systems Perform security audit: review of security practices and proceduresCopyright © 2012 Pearson Education Slide 4-68 32
  33. 33. Developing an E-commerce Security PlanFigure 4.14, Page 290Copyright © 2012 Pearson Education Slide 4-69 The Role of Laws and Public Policy Laws that give authorities tools for identifying, tracing, prosecuting cybercriminals: National Information Infrastructure Protection Act of 1996 USA Patriot Act Homeland Security Act Private and private-public cooperation CERT Coordination Center US-CERT Government policies and controls on encryption software OECD guidelinesCopyright © 2012 Pearson Education Slide 4-70 33
  34. 34. Copyright © 2012 Pearson Education Slide 4-71Copyright © 2012 Pearson Education Slide 4-72 34
  35. 35. Copyright © 2012 Pearson Education Slide 4-73 35