The document discusses various aspects of e-commerce security. It defines e-commerce security and outlines six key dimensions: integrity, nonrepudiation, authenticity, confidentiality, privacy, and availability. It also discusses basic security issues like authentication, authorization, and auditing. The document outlines different types of attacks including technical attacks, malware, viruses, and worms. It discusses common mistakes in managing security risks and outlines the three phases of security risk management: asset identification, risk assessment, and implementation. Finally, it briefly explains some security concepts and technologies like encryption, VPNs, honeypots, and tokens.

1. WelcomeWelcome
ToTo
My Presentation.
Syed Maniruzzaman Pabel
ID:142-15-4186
Daffodil International University

2. Our Topic :
E-Commerce Security
2

3. What is E-Commerce Security
E-commerce security is the protection of e-
commerce assets from unauthorized access, use,
alteration, or destruction.
3

4. Six dimensions of e-commerce security:
1. Integrity
2. Nonrepudiation
3. Authenticity
4. Confidentiality
5. Privacy
6. Availability
4

5. The Continuing Need for E-Commerce Security:
Computer Security Institute (CSI)
Nonprofit organization located in San Francisco,
California, that is dedicated to serving and training
information, computer, and network security
professionals
Computer Emergency Response Team (CERT)
Group of three teams at Carnegie Mellon University
that monitor the incidence of cyber attacks, analyze
vulnerabilities, and provide guidance on protecting
against attacks
5

6. Basic Security Issues:
Authentication
Authorization
Auditing
6

7. Nontechnical attack:
An attack that uses chicanery to trick people into
revealing sensitive information or performing actions
that compromise the security of a network
7

8. Technical attack:
An attack perpetrated using software and systems
knowledge or expertise
8

9. Types of technical attack:
common (security) vulnerabilities and
exposures (CVEs
National Infrastructure Protection Center
(NIPC)
denial-of-service (DoS) attack
distributed denial-ofservice (DDoS) attack
9

10. Malware:
A generic term for malicious software
Example:
10

11. Virus and Worm:
virus
A piece of software code that inserts itself into a host,
including the operating systems, in order to propagate;
it requires that its host program be run to activate it
worm
A software program that runs independently, consuming
the resources of its host in order to maintain itself, that
is capable of propagating a complete working version of
itself onto another machine
11

12. Common mistakes in managing
security risks:
 Undervalued information
 Narrowly defined security boundaries
 Reactive security management
 Dated security management processes
 Lack of communication about security
responsibilities
12

13. Security Risk Management:
A systematic process for determining the likelihood
of various security attacks and for identifying the
actions needed to prevent or mitigate those attacks
13

14. Security risk management consists of three
phases:
 Asset identification
 Risk assessment
 Implementation
14

15. passive tokens and active tokens:
passive tokens
Storage devices (e.g., magnetic strips) that contain a
secret code used in a two-factor authentication
system
active tokens
Small, stand-alone electronic devices that generate
one-time passwords used in a two-factor
authentication system
15

16. Symmetric (Private) Key
Encryption:
16

17. Public (Asymmetric) Key Encryption:
public key encryption
Method of encryption that uses a pair of
matched keys—a public key to encrypt a
message and a private key to decrypt it, or
vice versa
public key
Encryption code that is publicly available to
anyone
17

18. virtual private network (VPN):
A network that uses the public Internet to carry
information but remains private by using
encryption to scramble the communications,
authentication to ensure that information has not
been tampered with, and access control to verify
the identity of anyone using the network
18

19. Honeynet and Honeypots:
honeynet
A way to evaluate vulnerabilities of an organization
by studying the types of attacks to which a site is
subjected using a network of systems called
honeypots
honeypots
Production systems (e.g., firewalls, routers, Web
servers, database servers) designed to do real work
but that are watched and studied as network
intrusions occur
19

20. Thank You
 Every Body
20