This document discusses the security needs for e-commerce services. It covers understanding e-commerce services and the importance of availability. It also discusses implementing security at the client-side, server-side, application, and database levels. Finally, it discusses developing a high-availability e-commerce architecture with redundancy to ensure security and uptime.

1. Lesson 19-E-Commerce
Security Needs

2. Overview
Understand e-commerce services.
Understand the importance of availability.
Implement client-side security.
Implement server-side security.
Implement application security.
Implement database server security.
Develop an e-commerce architecture.

3. Understand E-Commerce
Services
Organizations perform e-commerce to make profit by
providing goods and services at a lower cost.
Providing electronic library functions for sensitive or
confidential information has come with the advent of e-
commerce over the Internet.

4. Understand E-Commerce
Services
E-commerce service is most commonly thought of as the
purchasing of goods.
Security to e-commerce services can be measured by its
confidentiality, integrity, and accountability.

5. Understand E-Commerce
Services
E-Commerce Services and regular DMZ Services differ in
their requirements.
Requirement of verification and confidentiality differentiate
the e-commerce services from regular DMZ services.
Availability becomes a critical security issue for the e-
commerce site.

6. Understand E-Commerce
Services
E-commerce services may involve selling goods, providing
confidential information, or distribution of information.
Security to e-commerce services can be measured in terms
of confidentiality, integrity, and accountability.

7. Understand the Importance of
Availability
Availability is the key issue for e-commerce services.
Availability of the site has a direct impact on the confidence
a customer will have in using the service.
Failure in availability is almost guaranteed to push a
potential customer to a competitor.

8. Understand the Importance of
Availability
Business-to-consumer issues:
The entire site along with payment processing must be up at
all times.
Problem of availability includes business issues such as ability
of the organization to fulfill orders entered into the system.
Size of the infrastructure must be built according to the
expected load.

9. Understand the Importance of
Availability
Business-to-business issues:
Business-to-business e-commerce is established between two
organizations that have some type of relationship.
Availability issues may be more stringent in Business-to-
business e-commerce.
When one organization needs to make an order, the other
organization must be able to receive and process it.

10. Understand the Importance of
Availability
Global time:
E-commerce availability is governed by the concept of global
time.
This concept identifies the global nature of the Internet and of
e-commerce.
An e-commerce site must be able to handle orders from
unexpected locations.

11. Understand the Importance of
Availability
Client comfort:
Client must feel comfortable with the ability of the
organization to process orders and deliver goods.
Customer comfort or discomfort can multiply quickly.

12. Understand the Importance of
Availability
Cost of downtime:
The cost of downtime is high.
It can be measured by taking the average number of
transactions over a period of time and the revenue of the
average transaction.
An e-commerce site must not have single points of failure.
The site should also have procedures for updating hardware
and software.

13. Understand the Importance of
Availability
Solving the availability problem:
Downtime can be reduced through redundancy.
For sites that expect large amounts of traffic, load-balancing
application layer switches can be used.
Network infrastructure components must also be configured to
fail-over if high availability is required.

14. Implement Client-Side
Security
Client-side security components

15. Implement Client-Side
Security
Client-side security deals with the security from the
customer’s desktop system to the e-commerce server.
A realistic solution to communications security is encryption
of information.

16. Implement Client-Side
Security
A cookie is a small amount of information that is stored on
the client system by the Web server in cleartext or
encrypted.
Organizations must ensure that a legitimate customer
places the order to reduce possible repudiation.

17. Implement Server-Side
Security
Security of servers includes:
Information stored on the server.
Protecting the server from attack.

18. Information Stored on the
Server
An e-commerce server is a semi-trusted or untrusted
system which should not store sensitive information.
If information is kept on the e-commerce server, it should
be protected from unauthorized access through file access
controls.

19. Protecting the Server from
Attack
Three categories in protecting an e-commerce server from
attack:
Server location.
Operating system configuration.
Web server configuration.

20. Server Location
Server should be located in a
protected area such as a data center.
If the server is placed at a co-
location facility, physical access to it
must be separated from other clients.
Firewall should be configured to
only allow access to e-commerce
server on ports 80 (for HTTP) and
443 (for HTTPS).

22. Operating System
Configuration
The first step in configuring the server securely is to
remove or turn off any unnecessary services.
The latest patches must be checked and loaded for the
chosen operating system.
The system should meet the organization’s policy and
vulnerability scan should be conducted.

23. Web Server Configuration
Web server must not be run as
root or administrator for security.
CGI scripts on Web server that
are not being used should be
removed to prevent intruder
attack.
Web server should be scanned
for known vulnerabilities.

24. Implement Application
Security
Security of e-commerce application as a whole is the most
important part of e-commerce security.
Security requirements should be included in the
requirements definition phase of project.
Security requirements include requirements pertaining to
protection, authentication, audit, availability, and
identifying sensitive information.

25. Implement Application
Security
All sensitive information needs to be protected.
Programs are a major source of system vulnerabilities due
to programming errors.
Buffer overflows can be reduced by not making
assumptions about the size of user input and not passing
unchecked user input to shell commands.
Peer review or code review can catch many programming
errors before the server goes into production.

26. Implement Application
Security
Vulnerability scanners should detect buffer overflow
problems before the site goes into production.
The two parts of configuration management are control of
authorized changes and identification of unauthorized
changes.
To prevent false alarms, checksum should be updated
during configuration management procedure.

27. Implement Database Server
Security
The database server may contain sensitive and confidential
information which should be protected.
Organizations must examine database location,
communication with e-commerce server, and internal
access protection.
Database servers must be kept in controlled areas.
The e-commerce server should initiate SQL connection to
the database server for processing transactions.

28. Implement Database Server
Security
The e-commerce server must
have an ID and password to
initiate an SQL connection to the
database server.
Employees of the organization
have access to internal network
and thus are able to directly
attack it.
Database server could be

29. Develop an E-Commerce
Architecture
A high-traffic and high-availability e-commerce site requires
two ISPs with fail-over capability.
Routers, switches, and firewalls should be cross-connected
so that failure of any one component will not affect traffic.
Redundant switches may be used to ensure availability of
the site.
Regular vulnerability scans and database auditing must be
conducted.

31. Summary
E-commerce service providers can increase revenue by
providing information to customers at a lower cost.
Security with respect to confidentiality, integrity, and
accountability plays a major role in e-commerce.
Availability is a key issue for e-commerce.
Client-side security protects information in transit,
information stored on customer’s computer, and prevents
repudiation.

32. Summary
Server-side security involves protection of information
stored on the server and protection of the server itself.
Security of the e-commerce application as a whole is
probably the most important part of e-commerce security.
Confidential and sensitive information present in the
database server must be protected.