This document discusses information security as it relates to e-commerce applications. It covers several technical security attack methods that e-commerce applications can be vulnerable to, including financial frauds, spam, phishing, bots, DDoS attacks, brute force attacks, SQL injections, XSS, and Trojan horses. It also discusses vulnerability assessments, penetration testing stages and methods, and ISO/IEC 27001:2013 as an international standard for managing information security risks.

1. Information Security
ICT2243 - E-Commerce Implementation,
Management & Security
by
TG/2017/233 - W. W. M. S. Karunasena
Lecturer in charge: Mrs. Iromi R. Paranavithana
Submission Date: 20th
April 2020
Bachelor of Information and Communication Technology
Department of Information and Communication Technology
Faculty of Technology
University of Ruhuna.

2. Contents
Introduction to InfoSec ..............................................................................................................3
Technical security attack methods that ecommerce applications can be vulnerable.................4
Vulnerability Assessments.........................................................................................................5
Penetration Testing ....................................................................................................................6
Penetration testing stages .......................................................................................................7
Penetration testing methods ...................................................................................................8
ISO/IEC 27001:2013 .................................................................................................................9

3. Introduction to InfoSec
Information Security is not all about securing information from unauthorized access.
Information Security is basically the practice of preventing unauthorized access, use,
disclosure, disruption, modification, inspection, recording or destruction of information.
Information can be physical or electrical one. Information can be anything like Your details or
we can say your profile on social media, your data in mobile phone, your biometrics etc. Thus,
Information Security spans so many research areas like Cryptography, Mobile Computing,
Cyber Forensics, Online Social Media etc.
During First World War, Multi-tier Classification System was developed keeping in mind
sensitivity of information. With the beginning of Second World War formal alignment of
Classification System was done. Alan Turing was the one who successfully decrypted Enigma
Machine which was used by Germans to encrypt warfare data.
Information Security programs are built around 3 objectives, commonly known as CIA –
Confidentiality, Integrity, Availability.
1. Confidentiality – means information is not disclosed to unauthorized individuals,
entities, and process. For example, if we say I have a password for my Gmail account,
but someone saw while I was doing a login into Gmail account. In that case my
password has been compromised and Confidentiality has been breached.
2. Integrity – means maintaining accuracy and completeness of data. This means data
cannot be edited in an unauthorized way. For example if an employee leaves an
organization then in that case data for that employee in all departments like accounts,
should be updated to reflect status to JOB LEFT so that data is complete and accurate
and in addition to this only authorized person should be allowed to edit employee data.
3. Availability – means information must be available when needed. For example, if one
needs to access information of a particular employee to check whether employee has
outstand the number of leaves, in that case it requires collaboration from different
organizational teams like network operations, development operations, incident
response and policy/change management.

4. Technical security attack methods that ecommerce applications can be
vulnerable
o Financial Frauds
Financial fraud has afflicted online businesses since their inception. Hackers make
unauthorized transactions and wipe out the trail costing businesses significant
amounts of losses. Some fraudsters also file requests for fake refunds or returns.
Refund fraud is a common financial fraud where businesses refund illegally
acquired products or damaged goods.
o Spam
Where emails are known as a strong medium for higher sales, it also remains one
of the highly used mediums for spamming. Nonetheless, comments on your blog or
contact forms are also an open invitation for online spammers where they leave
infected links in order to harm you. They often send them via social media inbox
and wait for you to click on such messages. Moreover, spamming not only affects
your website’s security, but it also damages your website speed too.
o Phishing
It is one of the common security threats of ecommerce where hackers masquerade
as legitimate businesses and send emails to your clients to trick them into revealing
their sensitive information by simply presenting them with a fake copy of your
legitimate website or anything that allows the customer to believe the request is
coming from the business.
o Bots
You may recognize bots from your good books such as those that crawl the web
and help you rank your website in Search Engine Result Pages. However, there are
exclusive bots developed to scrape websites for their pricing and inventory
information. The hackers use such information to change the pricing of your online
store, or to garner the best-selling inventory in shopping carts, resulting in a decline
in sales and revenue.
o DDoS Attacks
Distributed Denial of Service (DDoS) attacks and DOS (Denial of Service) attacks
aim to disrupt your website and affect overall sales. These attacks flood your servers
with numerous requests until they succumb to them and your website crashes.

5. o Brute Force Attacks
These attacks target your online store’s admin panel in an attempt to figure out your
password by brute-force. It uses programs that establish a connection to your
website and use every possible combination to crack your password. You can
protect yourself against such attacks by using a strong, complex password. Do
remember to change it regularly.
o SQL Injections
SQL injections are cyber-attacks intended to access your database by targeting your
query submission forms. They inject malicious code in your database, collect the
data and then delete it later on.
o XSS
Hackers target your website visitors by infecting your online store with malign
code. You can safeguard yourself against it by implementing Content Security
Policy.
o Trojan Horses
Admins and customers might have Trojan Horses downloaded on their systems. It
is one amongst the worst network security threats where attackers use these
programs to swipe sensitive information from their computers with ease.
Vulnerability Assessments
A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or
ranking) the vulnerabilities in a system. Examples of systems for which vulnerability
assessments are performed include, but are not limited to, information technology systems,
energy supply systems, water supply systems, transportation systems, and communication
systems. Such assessments may be conducted on behalf of a range of different organizations,
from small businesses up to large regional infrastructures. Vulnerability from the perspective
of disaster management means assessing the threats from potential hazards to the population
and to infrastructure. It may be conducted in the political, social, economic, or environmental
fields.

6. Vulnerability assessment has many things in common with risk assessment. Assessments are
typically performed according to the following steps:
1. Cataloging assets and capabilities (resources) in a system.
2. Assigning quantifiable value (or at least rank order) and importance to those resources
3. Identifying the vulnerabilities or potential threats to each resource
4. Mitigating or eliminating the most serious vulnerabilities for the most valuable
resources.
Penetration Testing
A penetration test, also known as a pen test, is a simulated cyber-attack against your computer
system to check for exploitable vulnerabilities. In the context of web application security,
penetration testing is commonly used to augment a web application firewall (WAF).
Pen testing can involve the attempted breaching of any number of application systems, (e.g.,
application protocol interfaces (APIs), frontend/backend servers) to uncover vulnerabilities,
such as unsensitized inputs that are susceptible to code injection attacks.
Insights provided by the penetration test can be used to fine-tune your WAF security policies
and patch detected vulnerabilities.

7. Penetration testing stages
1. Planning and reconnaissance
The first stage involves:
Defining the scope and goals of a test, including the systems to be addressed and the
testing methods to be used.
Gathering intelligence (e.g., network and domain names, mail server) to better
understand how a target works and its potential vulnerabilities.
2. Scanning
The next step is to understand how the target application will respond to various
intrusion attempts. This is typically done using:
Static analysis – Inspecting an application’s code to estimate the way it behaves while
running. These tools can scan the entirety of the code in a single pass.
Dynamic analysis – Inspecting an application’s code in a running state. This is a more
practical way of scanning, as it provides a real-time view into an application’s
performance.
3. Gaining Access
This stage uses web application attacks, such as cross-site scripting, SQL injection
and backdoors, to uncover a target’s vulnerabilities. Testers then try and exploit these
vulnerabilities, typically by escalating privileges, stealing data, intercepting traffic,
etc., to understand the damage they can cause.

8. 4. Maintaining access
The goal of this stage is to see if the vulnerability can be used to achieve a persistent
presence in the exploited system— long enough for a bad actor to gain in-depth
access. The idea is to imitate advanced persistent threats, which often remain in a
system for months in order to steal an organization’s most sensitive data.
5. Analysis
The results of the penetration test are then compiled into a report detailing:
Specific vulnerabilities that were exploited
Sensitive data that was accessed
The amount of time the pen tester was able to remain in the system undetected
This information is analyzed by security personnel to help configure an enterprise’s WAF
settings and other application security solutions to patch vulnerabilities and protect against
future attacks.
Penetration testing methods
External testing
External penetration tests target the assets of a company that are visible on the internet, e.g.,
the web application itself, the company website, and email and domain name servers (DNS).
The goal is to gain access and extract valuable data.
Internal testing
In an internal test, a tester with access to an application behind its firewall simulates an attack
by a malicious insider. This is not necessarily simulating a rogue employee. A common starting
scenario can be an employee whose credentials were stolen due to a phishing attack.
Blind testing
In a blind test, a tester is only given the name of the enterprise that is being targeted. This gives
security personnel a real-time look into how an actual application assault would take place.
Double-blind testing

9. In a double-blind test, security personnel have no prior knowledge of the simulated attack. As
in the real world, they will not have any time to shore up their defenses before an attempted
breach.
Targeted testing
In this scenario, both the tester and security personnel work together and keep each other
appraised of their movements. This is a valuable training exercise that provides a security team
with real-time feedback from a hacker’s point of view.
ISO/IEC 27001:2013
ISO 27001 is the international standard which is recognized globally for managing risks to the
security of information you hold. Certification to ISO 27001 allows you to prove to your clients
and other stakeholders that you are managing the security of your information. ISO 27001:2013
(the current version of ISO 27001) provides a set of standardized requirements for an
Information Security Management System (ISMS). The standard adopts a process-based
approach for establishing, implementing, operating, monitoring, maintaining, and improving
your ISMS.