More Related Content
Similar to Security in e commerce (20)
Security in e commerce
- 1. Security in E-Commerce Presented By Akhand Pratap Singh
- 2. What is Security • Security is an essential part of any transaction that takes place over the internet. Customer will loose his/her faith in e-business if its security is compromised. Following are the essential requirements for safe e- payments/transactions
- 4. • Confidentiality • Integrity • Availability • Authenticity • Non-Repudiability • Encryption • Auditabilty
- 5. Measure to insure security • Encryption • Digital signature • Security Certificates
- 6. Security Protocols in Internet • SSL(Secure Socket Layer) • It is the most commonly used protocol and is widely used across the industry. It meets following security requirements − • Authentication • Encryption • Integrity • Non-reputability
- 7. Secure Electronic Transaction • Card Holder's Digital Wallet Software • Merchant Software • Payment Gateway Server Software • Certificate Authority Software
- 8. The Tension Between Security and Other Values • Security vs. ease of use: The more security measures that are added, the more difficult a site is to use, and the slower it becomes • Security vs. desire of individuals to act anonymously
- 9. Security Threats in the E-commerce Environment • Three key points of vulnerability: Client Server Communications channel • Most common threats: Malicious code Hacking Credit card fraud/theft Spoofing Denial of service attacks Sniffing Insider jobs
- 10. A Logical Design for a Simple Web Site
- 11. Vulnerable Points in an E-commerce Environment
- 12. Malicious Code • Viruses: computer program that as ability to replicate and spread to other files; most also deliver a “payload” of some sort (may be destructive or benign); include macro viruses, file-infecting viruses and script viruses • Worms: designed to spread from computer to computer • Trojan horse: appears to be benign, but then does something other than expected • Bad applets (malicious mobile code): malicious Java applets or ActiveX controls that may be downloaded onto client and activated merely by surfing to a Web site
- 13. Spoofing, DoS and dDoS Attacks, Sniffing, Insider Jobs • Spoofing: Misrepresenting oneself by using fake e-mail addresses or masquerading as someone else • Denial of service (DoS) attack: Hackers flood Web site with useless traffic to inundate and overwhelm network • Distributed denial of service (dDoS) attack: hackers use numerous computers to attack target network from numerous launch points • Sniffing: type of eavesdropping program that monitors information traveling over a network; enables hackers to steal proprietary information from anywhere on a network • Insider jobs: single largest financial threat
- 15. Hacking and Cybervandalism • Hacker: Individual who intends to gain unauthorized access to a computer systems • Cracker: Used to denote hacker with criminal intent (two terms often used interchangeably) • Cybervandalism: Intentionally disrupting, defacing or destroying a Web site • Types of hackers include: White hats – Members of “tiger teams” used by corporate security departments to test their own security measures Black hats – Act with the intention of causing harm Grey hats – Believe they are pursuing some greater good by breaking in and revealing system flaws
- 16. Technology Solutions • Protecting Internet communications (encryption) • Securing channels of communication (SSL secure sockets layer), S-HTTP, VPNs) URL changes from HTTP to HTTPS • SSL: Protocol that provides secure communications between client and server • Protecting networks (firewalls) • Protecting servers and clients
- 17. Tools Available to Achieve Site Security
- 18. Protecting Internet Communications: Encryption • Encryption: The process of transforming plain text or data into cipher text that cannot be read by anyone other than the sender and receiver • Purpose: Secure stored information Secure information transmission • Provides: Message integrity: Nonrepudiation Authentication Confidentiality
- 19. Encryption ensures: Message integrity: provides assurance that message has been altered Nonrepudiation: prevents the user from denying he or she sent the message Authentication: provides verification of the identity of the person or machine sending the message Confidentiality: gives assurance that the message was not read by others
- 20. Symmetric Key Encryption • Also known as secret key encryption • Both the sender and receiver use the same digital key to encrypt and decrypt message • Requires a different set of keys for each transaction • Data Encryption Standard (DES): Most widely used symmetric key encryption today; uses 56-bit encryption key; other types use 128-bit keys up through 2048 bits
- 21. Public Key Encryption • Public key cryptography solves symmetric key encryption problem of having to exchange secret key • Uses two mathematically related digital keys – public key (widely disseminated) and private key (kept secret by owner) • Both keys are used to encrypt and decrypt message • Once key is used to encrypt message, same key cannot be used to decrypt message • For example, sender uses recipient’s public key to encrypt message; recipient uses his/her private key to decrypt it
- 22. Public Key Cryptography – A Simple Case
- 23. Digital Envelopes • Addresses weaknesses of public key encryption (computationally slow, decreases transmission speed, increases processing time) and symmetric key encryption (faster, but more secure) • Uses symmetric key encryption to encrypt document but public key encryption to encrypt and send symmetric key
- 24. Secure Negotiated Sessions Using SSL
- 25. Protecting Networks: Firewalls and Proxy Servers • Firewall: Software application that acts as a filter between a company’s private network and the Internet • Firewall methods include: Packet filters Application gateways • Proxy servers: Software servers that handle all communications originating from for being sent to the Internet (act as “spokesperson” or “bodyguard” for the organization)
- 26. Firewalls and Proxy Servers
- 27. Protecting Servers and Clients • Operating system controls: Authentication and access control mechanisms • Anti-virus software: Easiest and least expensive way to prevent threats to system integrity