Understand e-commerce services.
Understand the importance of availability.
Implement client-side security.
Implement server-side security.
Implement application security.
Implement database server security.
Develop an e-commerce architecture.
3. Understand E-Commerce
Organizations perform e-commerce to make profit by
providing goods and services at a lower cost.
Providing electronic library functions for sensitive or
confidential information has come with the advent of e-
commerce over the Internet.
4. Understand E-Commerce
E-commerce service is most commonly thought of as the
purchasing of goods.
Security to e-commerce services can be measured by its
confidentiality, integrity, and accountability.
5. Understand E-Commerce
E-Commerce Services and regular DMZ Services differ in
Requirement of verification and confidentiality differentiate
the e-commerce services from regular DMZ services.
Availability becomes a critical security issue for the e-
6. Understand E-Commerce
E-commerce services may involve selling goods, providing
confidential information, or distribution of information.
Security to e-commerce services can be measured in terms
of confidentiality, integrity, and accountability.
7. Understand the Importance of
Availability is the key issue for e-commerce services.
Availability of the site has a direct impact on the confidence
a customer will have in using the service.
Failure in availability is almost guaranteed to push a
potential customer to a competitor.
8. Understand the Importance of
The entire site along with payment processing must be up at
Problem of availability includes business issues such as ability
of the organization to fulfill orders entered into the system.
Size of the infrastructure must be built according to the
9. Understand the Importance of
Business-to-business e-commerce is established between two
organizations that have some type of relationship.
Availability issues may be more stringent in Business-to-
When one organization needs to make an order, the other
organization must be able to receive and process it.
10. Understand the Importance of
E-commerce availability is governed by the concept of global
This concept identifies the global nature of the Internet and of
An e-commerce site must be able to handle orders from
11. Understand the Importance of
Client must feel comfortable with the ability of the
organization to process orders and deliver goods.
Customer comfort or discomfort can multiply quickly.
12. Understand the Importance of
Cost of downtime:
The cost of downtime is high.
It can be measured by taking the average number of
transactions over a period of time and the revenue of the
An e-commerce site must not have single points of failure.
The site should also have procedures for updating hardware
13. Understand the Importance of
Solving the availability problem:
Downtime can be reduced through redundancy.
For sites that expect large amounts of traffic, load-balancing
application layer switches can be used.
Network infrastructure components must also be configured to
fail-over if high availability is required.
15. Implement Client-Side
Client-side security deals with the security from the
customer’s desktop system to the e-commerce server.
A realistic solution to communications security is encryption
16. Implement Client-Side
A cookie is a small amount of information that is stored on
the client system by the Web server in cleartext or
Organizations must ensure that a legitimate customer
places the order to reduce possible repudiation.
17. Implement Server-Side
Security of servers includes:
Information stored on the server.
Protecting the server from attack.
18. Information Stored on the
An e-commerce server is a semi-trusted or untrusted
system which should not store sensitive information.
If information is kept on the e-commerce server, it should
be protected from unauthorized access through file access
19. Protecting the Server from
Three categories in protecting an e-commerce server from
Operating system configuration.
Web server configuration.
20. Server Location
Server should be located in a
protected area such as a data center.
If the server is placed at a co-
location facility, physical access to it
must be separated from other clients.
Firewall should be configured to
only allow access to e-commerce
server on ports 80 (for HTTP) and
443 (for HTTPS).
21. Operating System
The first step in configuring the server securely is to
remove or turn off any unnecessary services.
The latest patches must be checked and loaded for the
chosen operating system.
The system should meet the organization’s policy and
vulnerability scan should be conducted.
22. Web Server Configuration
Web server must not be run as
root or administrator for security.
CGI scripts on Web server that
are not being used should be
removed to prevent intruder
Web server should be scanned
for known vulnerabilities.
23. Implement Application
Security of e-commerce application as a whole is the most
important part of e-commerce security.
Security requirements should be included in the
requirements definition phase of project.
Security requirements include requirements pertaining to
protection, authentication, audit, availability, and
identifying sensitive information.
24. Implement Application
All sensitive information needs to be protected.
Programs are a major source of system vulnerabilities due
to programming errors.
Buffer overflows can be reduced by not making
assumptions about the size of user input and not passing
unchecked user input to shell commands.
Peer review or code review can catch many programming
errors before the server goes into production.
25. Implement Application
Vulnerability scanners should detect buffer overflow
problems before the site goes into production.
The two parts of configuration management are control of
authorized changes and identification of unauthorized
To prevent false alarms, checksum should be updated
during configuration management procedure.
26. Implement Database Server
The database server may contain sensitive and confidential
information which should be protected.
Organizations must examine database location,
communication with e-commerce server, and internal
Database servers must be kept in controlled areas.
The e-commerce server should initiate SQL connection to
the database server for processing transactions.
27. Implement Database Server
The e-commerce server must
have an ID and password to
initiate an SQL connection to the
Employees of the organization
have access to internal network
and thus are able to directly
Database server could be
28. Develop an E-Commerce
A high-traffic and high-availability e-commerce site requires
two ISPs with fail-over capability.
Routers, switches, and firewalls should be cross-connected
so that failure of any one component will not affect traffic.
Redundant switches may be used to ensure availability of
Regular vulnerability scans and database auditing must be
E-commerce service providers can increase revenue by
providing information to customers at a lower cost.
Security with respect to confidentiality, integrity, and
accountability plays a major role in e-commerce.
Availability is a key issue for e-commerce.
Client-side security protects information in transit,
information stored on customer’s computer, and prevents
Server-side security involves protection of information
stored on the server and protection of the server itself.
Security of the e-commerce application as a whole is
probably the most important part of e-commerce security.
Confidential and sensitive information present in the
database server must be protected.