Please enable JavaScript.

Coggle requires JavaScript to display documents.

E-COMMERCE SECURITY (INSIGHT OF BUSINESS (SPOOFING,PHARMING, AND…

- - - - involves attempting to hide
        a true identity by using
        someone else’s e-mail or IP
        address.
    - - automatically redirecting a
        Web link to an address
        different from the intended
        one, with the site masquerading
        as the intended
        destination
    - - also referred to as link
        farms; promise to offer
        products or services, but in
        fact are just collections of
        advertisements
  - - - flooding a Web site with
        useless traffic to inundate
        and overwhelm the
        network
    - - using numerous computers
        to attack the target
        network from numerous
        launch points
  - - - takes advantage of poorly
        coded Web application
        software that fails to
        properly validate or filter
        data entered by a user on a
        Web page
    - - software vulnerability that
        has been previously unreported
        and for which no
        patch yet exists
  - - - Viruses, site takeovers, identity fraud,
        malware-loaded apps, click hijacking, phishing, and spam are all found on social
        networks (US-CERT, 2011)
      - Most attacks are social engineering attacks that tempt visitors to click on links
        that sound reasonable
      - Social apps downloaded from either the social network or a foreign
        site are not certified by the social network to be clean of malware. It’s “clicker beware.”
    - - Mobile
        users are filling their devices with personal and financial information, and using them
        to conduct an increasing number of transactions, from retail purchases to mobile
        banking, making them excellent targets for hackers.
      - The first malicious iPhone app was discovered and removed from the
        iTunes Store. Many
      - Vishing attacks target gullible cell phone users with verbal messages to call a
        certain number
      - smishing attacks exploit SMS/text messages. Compromised text messages can contain e-mail
        and Web site addresses that can lead the innocent user to a malware site
      - Madware—innocent-looking apps that contain adware that launches pop-up ads
    - - DDoS attacks threaten the availability of cloud services on
        which more and more companies are relying. Safeguarding data being maintained in a
        cloud environment is also a major concern.
      - the risks involved as devices, identities,
        and data become more and more interconnected in the cloud.
- - - - the process of transforming
        plain text or data into
        cipher text that cannot be
        read by anyone other than
        the sender and the receiver.
        The purpose of encryption
        is (a) to secure stored
        information and (b) to
        secure information
        transmission
      - provide four of the six key dimensions of e-commerce security:
        • Message integrity—provides assurance that the message has not been altered.
        • Nonrepudiation—prevents the user from denying he or she sent the message.
        • Authentication—provides verification of the identity of the person (or computer)
        sending the message.
        • Confidentiality—gives assurance that the message was not read by others.
      - A key (or cipher) is any method for transforming plain text to cipher text.
      - encrypted using substitution and transposition ciphers
        
        substitution ciphers
        
        every occurrence of a given
        letter is replaced systematically
        by another letter
        
        transposition ciphers
        
        the ordering of the letters
        in each word is changed in
        some systematic way
      - Symmetric Key Encryption (Secret Key Encryption)
        
        both the sender and the
        receiver use the same key
        to encrypt and decrypt the
        message
        
        Data Encryption
        Standard (DES)
        
        developed by the National
        Security Agency (NSA) and
        IBM. Uses a 56-bit encryption
        key
        
        Advanced Encryption
        Standard (AES)
        
        the most widely used
        symmetric key encryption
        algorithm, offering 128-,
        192-, and 256-bit keys
      - Public Key Symmetric
        
        public key
        cryptography
        two mathematically related
        digital keys are used: a
        public key and a private
        key. The private key is kept
        secret by the owner, and
        the public key is widely
        disseminated. Both keys
        can be used to encrypt and
        decrypt a message.
        However, once the keys are
        used to encrypt a message,
        that same key cannot be
        used to unencrypt the
        message
        
        Public Key Encryption Using Digital Signatures and Hash Digests
        
        a hash function is used first to create a digest of the message. A hash function is an
        algorithm that produces a fixed-length number called a hash or message digest
        
        To ensure the authenticity of the message and to
        ensure nonrepudiation, the sender encrypts the entire block of cipher text one more
        time using the sender’s private key. This produces a digital signature (also called an
        e-signature) or “signed” cipher text that can be sent over the Internet.
- - - - “good” hackers who help
        organizations locate and
        fix security flaws
    - - hackers who act with the
        intention of causing harm
    - - hackers who believe they
        are pursuing some greater
        good by breaking in and
        revealing system flaws
- - - - Wireless (WiFi) networks
        -Early WiFi used security standard call Wired Equivalent Privacy (WEP)
        
        WEP very weak n easy for hackers to crack.
        
        Now days, use WPA2 which use AES algorithm for encryption n CCMP, more advanced authentication code protocol.
      - Firewalls
        
        Filter communication packet n prevents some packet from entering / exit network based on security policy,
        
        Filter traffic based on packet attributes such as IP address, destination port,type of services, domain name of source.
        
        Only allow connection from server that request from services.
        
        2 major method firewall validate traffic:
        1) packet filter
        2) application gateway
        packet filter examine data packet to determine whether they're destined for prohibited port or originate from a prohibited IP address
        filters communications based on
        the application being requested, rather than the source or destination of the message
        
        Proxy Server
        
        Handle all communication originating from or being sent to Internet by local client acting as bodyguard for organization
        
        Limit access of internal clients to external Internet servers, although some proxy servers act as firewalls as well.
        
        Internal computers= the gateway,
        
        External computers = mail server or
        numeric address.
        
        Improve Web performance by storing frequently requested Web pages
        
        Intrusion Detection and Prevention Systems
        
        Intrusion detection system (IDS)
        examines network traffic, watching to see if it matches certain patterns or reconfigured rules indicative of an attack
        
        Intrusion prevention system (IPS)
        all the functionality of an IDS, with the additional ability to take steps to prevent and block suspicious activities
        
        Operating System Security Enhancements
        
        Obvious way to protect servers and clients is to take advantage of automatic computer security upgrades
        
        Operating systems on the Internet, you are prompted and informed that operating system enhancements are available
        
        Most popular Internet browsers are updated automatically with little user intervention.
        
        Anti-Virus Software
        
        To prevent threats to system integrity is to install anti-virus software
        
        Inexpensive tools to identify and eradicate the most common types of malicious code as they enter a computer
        
        -Suite packages and stand-alone programs are available to eliminate intruders such as bot programs, adware, and other security risks.
      - -
- - - - program that installs itself on a computer, typically without the user’s informed consent
        
        ADWARE
        
        a PUP that serves pop-up ads to your computer
        
        BROWSER PARASITE
        
        a program that can monitor and change the settings of a user’s browser
        
        SPYWARE
        
        a program used to obtain information such as a user’s keystrokes, e-mail, instant messages, and so on
    - - any deceptive, online attempt by a third party to obtain confidential information for financial gain
        
        SOCIAL ENGINEERING
        
        exploitation of human fallibility and gullibility to distribute malware
    - - includes a variety of threats such as viruses, worms,Trojan horses, and bots
        
        DRIVE-BY DOWNLOAD
        
        malware that comes with a downloaded file that a user requests
        
        VIRUS
        
        a computer program that has the ability to replicate or make copies of itself,and spread to other files
        
        WORM
        
        malware that is designed to spread from computer to computer
        
        RANSOMWARE (SCAREWARE)
        
        malware that prevents you from accessing your computer or files and demands that you pay a fine
        
        TROJAN HORSES
        
        appears to be benign, but then does something other than expected.
        
        BACKDOOR
        
        feature of viruses, worms and Trojans that allows an attacker to remotely access a compromised computer
        
        BOT
        
        type of malicious code that can be covertly installed on a computer when connected to the Internet
        
        BOTNET
        
        collection of captured bot computers
- - - - immediately debits a
        checking or other demanddeposit
        account
    - - account created by depositing
        funds into an account
        and from which funds are
        paid out or withdrawn as
        needed
    - - funds transferred directly via a signed draft or check from a consumer’s checking account to a merchant or other individual
        
        Not anonymous and require third-party institutions to work.
        
        Introduce security risks for merchants
    - - account that accumulates
        expenditures and to which
        consumers make periodic
        payments
    - - legal tender defined by a national authority to represent value.
        
        portable, requires no authentication, and provides instant
        purchasing power for those who possess it
        
        Allows for micro payments
  - - - merchants
        
        interested primarily in low-risk, low-cost, irrefutable (i.e., final),
        secure, and reliable payment mechanisms.
      - financial
        intermediaries
        
        such as banks and credit card networks, are primarily
        interested in secure payment systems that transfer risks and costs to consumers and
        merchants, while maximizing transaction fees payable to themselves.
      - consumers
        
        interested primarily in low-risk, low-cost, refutable (able
        to be repudiated or denied), convenient, and reliable payment mechanisms
      - government regulators
        
        interested in maintaining trust in the financial system
  - - - a bank account that allows
        companies to process
        credit card payments and
        receive funds from those
        transactions
  - - - permits consumers to make
        instant, online payments to
        merchants and other
        individuals based on value
        stored in an online account
  - - - a set of short-range wireless
        technologies used to
        share information among
        devices
  - - - an alternative payment
        system in which unique,
        authenticated tokens
        represent cash value
    - - typically circulates within
        an internal virtual world
        community or is issued by
        a specific corporate entity,
        and used to purchase
        virtual goods