Explain the six requirements of E-Commerce security and give a specific example.

1. E-Commerce
Explain the six requirements of E-Commerce security
and give a specific example.
Submitted By
Mohammad Tawhidur Rahman
Bangladesh
Date of Submission:
22 September, 2015

2. Mohammad Tawhidur Rahman P-2
Question # 2 : Explain the six requirements of E-Commerce security and
give a specific example.
Answer # 2 :
E-commerce is widely considered the buying and selling of products over the internet, but
any transaction that is completed solely through electronic measures can be considered e-
commerce. Day by day E-commerce playing very good role in online retail marketing and
peoples are using this technology all over the world.
E-commerce security is the protection of e-commerce assets from unauthorized access, use,
alteration, or destruction. E-commerce Security is a part of the Information Security
framework and is specifically applied to the components that affect e-commerce that
include Computer Security, Data security and other wider realms of the Information
Security framework.
E-commerce security has its own particular nuances and is one of the highest visible
security components that affect the end user through their daily payment interaction with
business.
Today, privacy and security are a major concern for electronic technologies. Privacy
concerns have been found, revealing a lack of trust in a variety of contexts, including
commerce, electronic health records, e-recruitment technology and social networking, and
this has directly influenced users. Security is one of the principal and continuing concerns
that restrict customers and organizations engaging with e-commerce.
Basic Requirements of E-commerce Security-
1. Secrecy : ability to ensure that messages and data are available only to those
authorized to view them. Also ensure that the trading party has the authority of
transaction. It prevents the risks of transactions and economic damage
2. Authenticity : ability to identify the identity of a person or entity with whom you
are dealing on the Internet assures that the “sender” of the message is actually the
person he/she claims.
The term “authentication” determines the user of the computer is actually who he/she
claims. The term “authentication of the receiver” allows the sender to be sure that the
party he/she intend to get the message is the one who is receives it.
3. Integrity : ability to ensure that information being displayed on a web site or
transmitted/received over the Internet has not been altered in any way by an
unauthorized party. It assures that the communication between trading parties are not
alerted by an enemy.
4. Availability : ability to ensure that an e-commerce site continues to function as
intended. Enables exchanging parties to maintain and revisit the history/sequence of
events during a period of transaction. In e-commerce, these could be computer time
stamps, or records of different computer of different stage of transactions.
5. Un-refuse able : ability to ensure that e-commerce participants do not deny (refuse)
online actions. Secure e-payment ensures that “commitment” to pay for goods/services
over media are met.

3. Mohammad Tawhidur Rahman P-3
6. Privacy : ability to control use of information a customer provides about
himself or herself to merchant. It assures that the communication between trading
parties are not revealed to other, therefore unauthorized party can not read or
understand the message.
E-commerce Threats -
Threats are anyone with the capability, technology, opportunity, and intent to do harm.
Potential threats can be foreign or domestic, internal or external, state-sponsored or a
single rogue element.
E-commerce security tools-
 Firewalls – Software and Hardware
 Public Key infrastructure
 Encryption software
 Digital certificates
 Digital Signatures
 Biometrics – retinal scan, fingerprints, voice etc
 Passwords
 Locks and bars – network operations centers
Each phase of E-commerce transaction has a security measure-
Transaction
phases
Information
phase
Negotiation
phase
Payment phase Delivery phase
Security
Measures
Confidentiality Secure Encryption Secure
Access control Contract Decryption Delivery
Integrity Identification Integrity
Checks Digital
signature
Checks
E-commerce threats and countermeasures in different avenues-
Avenue Threats Countermeasure
Intellectual
property
- Use existing materials
found on the Internet
without the owner's
permission.
e.g., music downloading,
domain name
(cybersquatting), software
pirating
 Legislature
 Authentication
Client
computer
 Trojan horse
 Active contents
 Viruses
 Privacy: Cookie
blockers; Anonymizer
 Digital certificate
 Browser protection
 Antivirus software
 Computer forensics expert
Communication
channel
 Sniffer program
 Backdoor
 Spoofing
 Denial-of-service
 Encryption:
- Public-key encryption (asymmetric) vs
Private-key encryption (symmetric)
- Encryption standard: Data Encryption
Standard (DES), Advanced Encryption
Standard (AES)

4. Mohammad Tawhidur Rahman P-4
 Protocol:
- Secure Sockets Layer (SSL)
- Secure Hyper Text Transfer Protocol
(S-HTTP)
 Digital signature:
Bind the message originator with the
exact contents of the message
- A hash function is used to transform
messages into a 128-bit digest (message
digest).
- The sender’s private key is used to
encrypt the message digest (digital
signature)
- The message + signature are sent to the
receiver
- The recipient uses the hash function to
recalculate the message digest
- The sender’s public key is used to
decrypt the message digest
- Check to see if the recalculated
message digest = decrypted message
digest
Server  Privilege setting
 Server Side Include
(SSI), Common
Gateway Interface (CGI)
 File transfer
 Spamming
 Access control and authentication:
- Digital signature from user
- Username and password
- Access control list
 Firewalls:
- Packet filter firewall: checks IP address
of incoming packet and rejects anything
that does not match the list of trusted
addresses
- Application level proxy server:
examines the application used for each
individual IP packet (e.g., HTTP, FTP)
to verify its authenticity.
- Stateful packet inspection: examines all
parts of the IP packet to determine
whether or not to accept or reject the
requested communication.
Example of Cryptography/ Encryption-
Cryptography/ encryption is the process of converting ordinary information (called
plaintext) into unintelligible text (called ciphertext). Decryption is the reverse, in other
words, moving from the unintelligible ciphertext back to plaintext.
 Plaintext : means the message
 Encryption :encoding(hiding the contents from outsiders) the message
 Ciphertext :the encrypted message
 Decryption :the process of retrieving the plaintext from the ciphertext
 “Encryption” and “Decryption” makes use of a “key and a coding method”.

5. Mohammad Tawhidur Rahman P-5
Just as the development of computers and electronics helped in cryptanalysis, it made
possible much more complex ciphers. Furthermore, computers allowed for the encryption
of any kind of data represent able in any binary format, unlike classical ciphers which only
encrypted written language texts; this was new and significant.
Concept of Encryption and Decryption-
The modern field of cryptography can be divided into several areas of study. Here I
discussed about two major areas of cryptography.
1. Symmetric-key cryptography
It refers to encryption methods in which
both the sender and receiver share the
same key (or, less commonly, in which
their keys are different, but related in an
easily computable way). This was the
only kind of encryption publicly known
until June 1976.
2. Asymmetric-key cryptography
Asymmetric-key system is constructed
that calculation of one key (the 'private
key') is computationally infeasible from
the other (the 'public key'), even though
they are necessarily related. Instead, both
keys are generated secretly, as an
interrelated pair. In asymmetric-key
cryptosystems, the public key may be
freely distributed, while its paired private
key must remain secret. In this system,
the public key is used for encryption,
while the private or secret key is used for
decryption.
The e-commerce industry is slowly addressing security issues on their internal networks.
There are guidelines for securing systems and networks available for the e-commerce
systems personnel to read and implement. Educating the consumer on security issues is
still in the infancy stage but will prove to be the most critical element of the e-commerce
security architecture. Privacy has become a major concern for consumers with the rise of
identity theft and impersonation, and any concern for consumers must be treated as a
major concern for e-commerce providers.
-THANK YOU-