E-COMMERCE SECURITYChapter 5

Learning Objectives• Understand the scope of e-commerce crime and security

problems• Describe the key dimensions of e-commerce security• Understand the tension between security and other values• Identify the key security threats in the e-commerce

environment• Describe how technology helps protect the security of

messages sent over the Internet• Identify the tools used to establish secure Internet

communications channels and protect networks, servers, and clients

• Appreciate the importance of policies, procedures, and laws in creating security

The E-Commerce Security Environment

• For most law-abiding citizens, the Internet holds the promise of a huge and convenient global marketplace

• For criminals, the Internet has created entirely new – and lucrative – ways to steal from the more than one billion Internet consumers worldwide

• It’s also less risky to steal online• For example, rather than rob a bank in person, the

Internet makes it possible to rob people remotely and almost anonymously

The Scope of the Problem• Cybercrime is becoming a more significant problem for

both organizations and consumers• A variety of worldwide cyberattacks make daily headlines• It is difficult to accurately estimate the actual amount of

cybercrime, but one source of information is the Ponemon Institute of 56 representative US companies

• The 2012 survey found that the average annual cybercrime cost for these organizations was $8.9 million

• The average cost per attack was $600,000• The number of attacks also increased by 40% compared

with the previous year

The Scope of the Problem (cont.)• Reports issued by security product providers, such as

Symantec, are another source of data• Advances in technology have reduced the entry costs and

skills required to enter the cybercrime business• Web attack kits may be purchased and they are

responsible for more than 60% of all malicious activity• Targeted attacks are increasing• Social networks are helping criminals identify individual

targets• Mobile platforms and applications are increasingly

vulnerable

Types of Attacks Against Computer Systems

The Underground Economy Marketplace:The Value of Stolen Information• Criminals who steal information on the Internet do not

always use this information themselves, but instead derive value by selling the information to others

• Table 5.2 lists some recently observed prices for stolen information, which typically vary depending on the quantity being purchased

• For example, stolen credit card information may be sold for $2-$90 in the black market

• As more credit card information is stolen, the value of this information has been declining

• In some cases, criminals are not necessarily after money but intend to deface, vandalize, and/or disrupt a Web site, rather than actually steal goods or services

What is Good E-Commerce Security?

• What is a secure commercial transaction?• Anytime you go into a marketplace you take risks, including

the loss of privacy• E-commerce merchants and consumers face many of the

same risks as participants in traditional commerce, albeit in a new digital environment

• Reducing risks in e-commerce is a complex process that involves new technologies, organizational policies and procedures, and new laws and industry standards that empower law enforcement officials to investigate and prosecute offenders

• Figure 5.1 illustrates the multi-layered nature of e-commerce security

The Tension Between Security and Other Values• Can there be too much security? The answer is yes.• Computer security adds overhead and expense to

business operations• Expanding computer security also has other downsides:

• Makes systems more difficult to use• Slows down the site• Increases need for more processing• Increases data storage demands

Security Threats in theE-Commerce Environment• From a technology perspective, there are three key points

of vulnerability when dealing with e-commerce:• the client• the server, and• the communications pipeline

• Figure 5.3 illustrates some of the things that can go wrong at each major vulnerability point in the transaction

Technology Solutions• It might seem like there is not much that can be done

about the onslaught of security breaches on the Internet• But in fact a great deal of progress has been made by

private security firms, corporate and home users, network administrators, technology firms, and government agencies

• There are two lines of defense:• Technology solutions• Policy solutions

• Tools available to achieve site security are summarized in Figure 5.5

Encryption• Encryption is the process of transforming plain text or data

into cipher text that cannot be read by anyone other than the sender and the receiver

• The purpose of encryption is to secure stored information and to secure information transmission

• One early encryption method was symmetric key encryption where both the sender and the receiver use the same key to encrypt and decrypt the message

• This method has some flaws:• Computers are so powerful that they can break the keys quickly• In order to share the key it may have to be sent over an insecure

medium where it could be stolen• In commercial use, you would need a secret key for each of the

parties with which you transact business

Public Key Encryption• In 1976, a new way of encrypting messages called public

key encryption was invented• Public key encryption solves the problem of exchanging

keys• In this method, two mathematically related digital keys are

used: a public key and a private key• Figure 5.6 illustrates a simple use of public key

cryptography and takes you through the important steps in using public and private keys

Public Key Cryptography

Limitations to Encryption Solutions• All forms of encryption have limitations• It is not effective against insiders• Protecting private keys may also be difficult because they

are stored on insecure desktop and laptop computers• Additional technology solutions exist for securing

channels of communications, networks, and servers/clients

Securing Communication Channels, Networks, Servers and Clients• Communication channel security technologies:

• Secure Sockets Layer (SSL)• Transport Layer Security (TLS)• Virtual Private Networks (VPNs)• Wi-Fi Protected Access (WPA2)

• Network protection technologies:• Firewalls• Proxy servers• Intrusion detection systems

• Server/client protection technologies• Operating system security enhancements• Anti-virus software

Management Policies, Business Procedures, and Public Laws• In 2013, companies worldwide are expected to spend

over $65 billion on security hardware, software, and services

• However, most CEOs and CIOs of existing e-commerce operations believe that technology is not the sole answer to managing the risk of e-commerce

• An e-commerce security plan would include a risk assessment, development of a security policy, implementation plan, creation of a security organization, and a security audit

• Implementation may involve expanded forms of access controls – IDs, passwords, access codes, biometrics (fingerprints, retina scans, speech recognition), etc.

The Roles of Laws and Public Policy• The public policy environment today is very different fro

the early days of e-commerce• The net result is that the Internet is no longer an

ungoverned, unsupervised, self-controlled technology juggernaut

• Table 5.5 lists the most significant federal e-commerce security legislation

• Several organizations are devoted to tracking down criminal organizations and individuals engaged in attacks against Internet and e-commerce sites• CERT Coordination Center at Carnegie Mellon University• US Computer Emergency Readiness Team (US-CERT) at US

Department of Homeland Security

Government Policies and Controls on Encryption Software• An interesting example of the difficulties involved in

enhancing security is the case of encryption software distribution

• Governments have sought to regulate the uses of encryption and to restrict availability and export of encryption systems as a means of preventing crime and terrorism

• On one hand, restricting global distribution of advanced encryption systems may reduce the likelihood that they may be cracked

• But it also reduces global Internet security if different countries have different levels of protection

• US policy permits exports except to pariah nations