Please enable JavaScript.

Coggle requires JavaScript to display documents.

CHAPTER 5 E-PAYMENT AND SECURITY IN E-COMMERCE :star:, 5.2 Security…

- - - - Payment processing
      - Authorization
      - Settlement
      - Fraud detection
      - Chargebacks
    - - No physical card
      - No card impression
      - No signature
    - - Consumer merchant
      - Clearinghouse
      - Merchant bank ( the “acquiring bank”)
      - The consumer’s card-issuing bank
      - Merchant account: A bank account that allows companies to process credit card payments and receive funds from those transactions.
  - - - Bank account specifically used for accepting customer payments
      - Holds on to funds before they’re transferred to the merchant’s primary business bank account
    - - Authorizes and processes online payments
      - Encrypts sensitive information, such as credit card numbers
      - Ensures secure transmission between the customer and the merchant
      - Payment gateway
  - - - American Express
      - Discover
      - Visa
      - JCB
      - MasterCard
  - - - Transaction processing system
        
        Composed of a distributed network of computers
        
        Blockchain system: transaction processing system that operates on a distributed and shared database(called a peer-to-peer) or (P2P network) rather than a single organization’s database.
      - Transaction database
        
        Grows over time as the firm processes the order
        
        Connected chain of blocks (or linked records) associated with that initial order
        
        Block of information created for every order
      - Benefits of Blockchain
        
        Reduces risks of storing and processing transaction information across thousands of firms
        
        Offers a single, simple, low-cost transaction system for participating firms
        
        Reduces cost of validating transactions
        
        Provides simplicity and security for storing and securing financial transactions, medical records, and other types of data
        
        Reduces cost of verifying users
        
        Foundation technology for cryptocurrencies and supply chain management
      - Technology enables organizations to create and verify transactions on the network nearly instantaneously without a central authority.
      - Risk of Distributed Transaction Database
        
        Poor security
        
        High administrative costs for merchants
        
        High risk for merchants
        
        High transaction costs for merchants
        
        Credit cards are not very democratic
    - - Acceptance of Bitcoin: gaining acceptance in the financial world
      - Decisions about the Future of Bitcoin
        
        Made by its community
        
        Often leads to disagreements
      - Perception of Bitcoin
        
        Some world governments and financial regulatory bodies perceive Bitcoin to be a potential threat to the sovereignty of their central banking systems
        
        Some world governments and financial regulatory bodies perceive Bitcoin to be a potential threat to the sovereignty of their central banking systems
        A number of countries, such as China and South Korea, have banned virtual currency exchanges
      - Altcoins
        
        Can be bought and sold along with Bitcoin on all major cryptocurrency exchanges
        
        Created to improve upon the model of Bitcoin or achieve slightly different goals
      - Bitcoin Software
        
        Ensures the accuracy of the blockchain
        
        Used to “mine” new Bitcoins into circulation
      - Market Share
        
        Bitcoin currently represents about 70% of the full market for cryptocurrencies
        
        Altcoins make up the remainder
      - Purely digital asset
        
        Bitcoin is the most prominent example of cryptocurrency in use today
        
        Many other cryptocurrencies have emerged in the last few years
        
        Works as a medium of exchange using cryptography
      - Initial coin offering( ICO): method of raising capital involving the issuance of cryptocurrency tokens that are used to purchase goods and services from that company.
  - - - Permits consumers to make instant, online payments to merchants/ individuals using their bank account or credit/debit cards
      - Available in 202 countries & 25 currencies around the world
      - Online stored value payment systems
      - Builds on existing financial infrastructure of the countries in which it operates
    - - Aimed at consumers who have concerns about entrusting their credit card information to unfamiliar online retailers
    - - Provides firms and government agencies with software that enables the transfer of funds
      - Uses the existing ACH system
      - Does not use major credit card processing systems
      - Digitally transfers funds in hours, rather than three or four days
      - Transfers money from a customer's bank account to firms they want to pay
      - Low transaction fees
      - Raised more than $50 million in venture funding since its inception in 2010
- - - - 5. Impact on Cybercrime and E-commerce:
        
        Businesses suffer significant losses, requiring constant security adaptation.
        
        Cybercrime continually evolves, posing new risks to e-commerce.
      - 4. Criminal Hierarchy
        
        Cybercriminals operate in a hierarchy: buyers/sellers, resellers, and technical experts
      - 3. Access and Vetting:
        
        Access involves vetting via Twitter, Tor, VPNs, and transactions using digital currencies like Bitcoin.
        
        Locating these markets is challenging for users and law enforcement.
      - 2. Market Dynamics:
        
        Prices fluctuate based on supply, freshness, and demand.
        
        Numerous global marketplaces sell stolen data and malware.
      - 1. Stolen Information's Value:
        
        Data serves as currency, with varying values based on freshness and quantity.
        
        Cybercriminals profit by selling stolen data in underground markets.
    - - Online credit card fraud is a significant problem in e-commerce.
        While individual losses are often small, the cumulative impact is substantial.
    - - According to Juniper Research (2019), retailers were estimated to lose around $130 billion in revenue globally between 2018 and 2023 due to card-not-present online payment fraud.
    - - Now involves the mass theft of millions of credit card numbers distributed among criminal gangs for widespread use.
      - Initially involved theft of single credit card numbers for limited purchases.
      - The nature of credit card fraud has evolved significantly.
    - - Identity fraud might increase the frequency and severity of credit card fraud incidents due to its association with stolen credit card details.
      - It often involves the use of stolen credit card information and creation of fake credit card accounts.
      - Identity fraud has emerged as a significant form of online/offline fraud.
  - - - Consumers risk non-receipt of purchased items; merchants risk non-payment or fraudulent transactions.
      - Digital theft mirrors traditional crimes like burglary and vandalism in the e-commerce landscape.
    - - Security involves a blend of technology, policies, laws, and industry standards, depicted in a multi-layered structure.
    - - Technology requires support from organizational policies to ensure effectiveness.
      - Laws and industry standards enforce payment mechanisms and investigate offenders.
    - - No security system is foolproof; adequate resources can breach any system.
      - Security doesn't need to be perfect indefinitely; it should be balanced against costs and potential losses.
    - - Security is as strong as its weakest link, emphasizing the need to manage vulnerabilities effectively.
    - - Effective e-commerce security requires a blend of laws, procedures, policies, and technologies to safeguard both individuals and organizations in the online marketplace.
  - - - Ensures data transmitted or displayed remains unaltered by unauthorized parties.
      - Example: Intercepting and changing online communications to redirect financial transactions.
    - - Ensures participants can't deny their online actions.
      - Example: Use of alias names in free email accounts leading to denial of posted comments or messages.
    - - Validates the identity of parties in online interactions.
      - Challenges include confirming the identity of website operators and customers.
    - - Ensures data is accessible only to authorized individuals.
      - Distinct from privacy, which involves controlling the use of personal information by e-commerce merchants.
    - - Involves controlling the use of customer-provided information.
      - Merchants need policies for internal use of customer data and safeguarding it from unauthorized access.
    - - Ensures uninterrupted functioning of e-commerce sites.
  - - - Increased security:
        
        +Adds operational overhead and expenses to businesses
        
        +Provides criminals with opportunities to conceal intentions and crimes.
      - Excessive security measures can have drawbacks.
    - - Security isn't always an unequivocal positive.
      - There's a need to strike a balance between robust security measures and the potential drawbacks it introduces.
    - - 1.Security vs. Usability Conflict:
        
        Increased security measures in e-commerce often make sites more complex and slower, impacting user experience.
        
        Excessive security can deter customers similar to locked shops deterring shoppers.
      - 2. Impact of Security Measures:
        
        Security demands, while necessary, add technological complexity and business overhead, potentially affecting profits.
        
        Balancing security is crucial; too much can harm profits, while too little can risk business.
      - 3.User Preferences and Attitudes:
        
        Customizing security settings to user preferences can improve the balance between security and usability.
        
        Consumer attitudes have shifted with high-profile data breaches, now showing increased tolerance for enhanced security, even at the expense of convenience.
    - - 1.Anonymity vs. Public Safety:
        
        Tension exists between individuals desiring anonymity and the necessity for public safety upheld by authorities.
        
        History shows the government's early wiretapping efforts to combat conspirators and terrorists, emphasizing the need for surveillance.
      - 2.Surveillance and Criminal Activities:
        
        Governments globally don't permit technological havens for criminal activities, including those on the internet.
        
        Criminal groups utilize various communication channels like voice, fax, internet, and encrypted email for illegal activities (e.g., financial fraud, information theft).
      - 3.Government Actions and Surveillance:
        
        Governments combat cybercriminals by shutting down forums facilitating the sale of stolen card numbers.
        
        Internet and mobile platforms also provide convenient communication channels for terrorists, prompting increased surveillance efforts by governments.
      - 4. Surveillance Controversies:
        
        NSA's extensive surveillance methods, as revealed by Edward Snowden, caused controversy.
        
        The balance between public safety and privacy in anti-terrorism efforts remains a challenging issue for the US government.
      - 5.Shift in Surveillance Tactics:
        
        Security agencies have moved from mass surveillance to targeted surveillance of terrorist groups using predictive algorithms.
- - - - Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
        
        SSL/TLS Implementation
        
        SSL/TLS protocols are commonly used to secure communication channels, indicated by the change in URL from HTTP to HTTPS.
        
        . Establishing Secure Sessions:
        
        SSL/TLS establishes secure negotiated sessions between client and server by encrypting URL data, form contents, and exchanged cookies.
        
        Digital Certificate Exchange:
        
        Browsers and servers verify each other's identity via digital certificates and agree upon strong encryption methods, utilizing a session key unique to the session.
        
        Server-Side Authentication
        
        SSL/TLS ensures server authentication but may not require client authentication, leaving room for optional verification.
        
        Limitations and Security Measures:
        
        While SSL/TLS provides encryption, server authentication, and message integrity, it doesn't ensure irrefutability. It protects against account hijacking via tools like Firesheep by encrypting cookies.
        
        Adoption in Federal Websites:
        
        Federal websites mandated the use of HTTPS by implementing HTTP Strict Transport Security (HSTS) to enforce secure communication, encrypting user requests to servers.
      - Virtual Private Networks (VPNs)
        
        Function of VPN: Allows secure remote access to a corporation's local area network through the internet.
        
        VPN Protocols: Various protocols are used to establish secure connections.
        
        Security Measures: VPNs employ authentication and encryption for confidentiality and integrity of information.
        
        Authentication's Role: Prevents identity spoofing and misrepresentation.
        
        Connection Process: Users connect to a remote private network via a local ISP as if directly dialed into the corporate network.
        
        Tunneling: VPN protocols establish a secure link through a process called tunneling, creating a private connection by encapsulating messages.
        
        Encryption: Messages transmitted through the internet are shielded by an encrypted wrapper, securing them from unauthorized access
      - Wireless (Wi-Fi) Networks
        
        Wireless Network Security: Accessing the internet through Wi-Fi networks poses specific security concerns.
        
        WEP (Wired Equivalent Privacy): Initially used encryption standard in early Wi-Fi networks, but it was weak and easily crackable by hackers.
        
        WPA (Wi-Fi Protected Access): Introduced as a more secure alternative to WEP but also became susceptible to intrusion.
        
        WPA2: Introduced in 2004 with AES encryption and CCMP authentication, offering higher security standards.
        
        WPA3: Developed by the Wi-Fi Alliance in 2018, implementing stronger key exchange protocols, improved IoT device connectivity, and enhanced encryption for public networks.
        
        Vulnerabilities in WPA3: Despite advancements, the updated WPA3 standard still has vulnerabilities that could potentially allow attackers to recover passwords.
      - PROTECTING NETWORKS
        
        Firewalls
        
        Purpose of Firewalls and Proxy Servers: Both serve as protective barriers for networks, akin to physical firewalls guarding against fires.
        
        Distinct Functions:
        
        Firewalls: Hardware or software that filters communication packets, controlling traffic based on a security policy.
        
        Proxy Servers: Share some functions with firewalls but are fundamentally different.
        
        Firewall Operations
        
        Filters communication packets, allowing or denying them based on a security policy.
        
        Controls traffic to and from servers and clients.
        
        Blocks communications from untrustworthy sources and permits those from trusted sources.
        
        Message Processing:
        
        Every message entering or leaving the network undergoes processing by the firewall.
        
        Determines if messages meet established security guidelines; allows or blocks messages accordingly.
        
        Filtering Attributes:
        
        Firewalls can filter traffic based on packet attributes like source.
        
        Proxy Servers
        
        Proxy Server Functionality:
        
        Proxies are software servers (often a dedicated computer) managing communications between local clients and the internet.
        .
        
        They act as intermediaries, representing the organization and controlling internet-bound and incoming communications.
        
        Limiting Access and Security:
        
        Primarily used to restrict internal client access to external internet servers.
        Some proxies also function as firewalls.
        
        Dual-Home Systems
        
        Proxies are termed dual-home systems due to having two network interfaces.
        
        Intrusion Detection and Prevention Systems
        
        Intrusion Detection System (IDS):
        
        Monitors network traffic, analyzing patterns or predefined rules to identify potential attacks.
        
        Detects suspicious activity, triggering alarms to notify administrators and logging events in a database
        
        Complements firewalls by catching malicious activities that firewalls might overlook.
        
        Intrusion Prevention System (IPS):
        
        Incorporates all functionalities of an IDS.
        
        Goes beyond detection by actively preventing and blocking suspicious activities.
  - - - It converts plain text into unreadable cipher text, ensuring only the sender and receiver can understand it. Its primary aims are securing stored data and transmission.
    - - Encryption supports four crucial security dimensions:
        
        Message Integrity: Ensures messages remain unaltered.
        
        Nonrepudiation: Prevents denial of message transmission.
        
        Authentication: Verifies the sender's identity.
        
        Confidentiality: Assures messages are unreadable by unauthorized parties
    - - Encryption operates through keys or ciphers, transforming plain text into cipher text.
    - - Ancient civilizations like the Egyptians and Phoenicians used substitution and transposition ciphers in commercial records.
        Cipher Examples:
        
        Substitution Cipher: Replaces letters systematically.
        
        Transposition Cipher: Rearranges letter order within words.
        
        Complex Methods: Intricate techniques involve breaking words into parts and rearranging letters creatively.
    - - Figures like Leonardo Da Vinci employed encryption, such as reversing text for readability only with a mirror.
    - - 1. Symmetric Key Cryptography
        
        Both sender and receiver use the same key to encrypt and decrypt messages, requiring secure key exchange.
        
        Vulnerabilities include susceptibility to powerful modern computers and the need for secure key transmission.
      - 2. Modern Digital Encryption:
        
        Utilizes binary strings to transform plain text into cipher text.
        
        Key strength determines security, with longer keys offering higher protection against decryption.
      - 3.Key Strength and Security:
        
        Longer keys (e.g., 128, 256, 512 bits) increase security by creating vast possibilities for decryption.
        
        Evolution of encryption standards includes DES, TDEA, and AES, each offering varying key sizes with AES facing security challenges in recent years.
      - 4. Challenges and Alternatives:
        
        Scaling symmetric key systems for commercial use becomes impractical due to the need for multiple keys in a large user population.
        
        Other symmetric key systems exist with longer keys but are less commonly used in practice.
    - - 1.Invention of Public Key Cryptography:
        
        In 1976, Whitfield Diffie and Martin Hellman introduced public key cryptography, also known as asymmetric cryptography.
        
        This innovation aimed to solve the key exchange problem by using two related keys: a public key and a private key.
      - 2. Function of Public and Private Keys:
        
        Public key is widely disseminated, while the private key is kept secret by its owner.
        
        Both keys can encrypt and decrypt a message, but the key used for encryption cannot be used for decryption.
      - 3. Irreversible Mathematical Functions:
        
        The mathematical algorithms generating these keys are one-way functions, making it impossible to derive the input from the output.
        
        Similar to how it's impossible to retrieve whole eggs from scrambled eggs, these functions are irreversible.
      - 4. Strength of Keys:
        
        Keys used in public key cryptography are sufficiently long (e.g., 128, 256, and 512 bits), requiring significant computing power to derive one key from another.
      - 5. Illustration of Public Key Cryptography
        
        Figure 4.6 presents a simple example demonstrating the use of public and private keys, outlining the essential steps involved in their utilization.
    - - 1. Ensuring Message Integrity:
        
        To verify a message's integrity and prevent alteration during transit, a hash function generates a fixed-length number called a hash or message digest.
        
        Hash functions vary in complexity, producing unique hashes for each message. For instance, MD4 and MD5 create 128- and 160-bit hashes, respectively.
      - 2. Verification of Unaltered Messages:
        
        Sender computes the hash and sends it along with the message. The recipient checks if the hash result matches after applying the same hash function, ensuring the message remains unchanged.
      - 3. Encryption and Digital Signature:
        
        Sender encrypts both the hash result and the original message using the recipient's public key, producing cipher text.
        
        Sender further encrypts the entire cipher text using their private key, creating a digital signature or "signed" cipher text, ensuring authenticity and nonrepudiation.
      - 4.Digital Signature's Unique Nature:
        
        Digital signatures, like handwritten signatures, are unique and tied to an individual's private key.
        
        When combined with a hash function, digital signatures become uniquely linked to both the individual and the specific document.
      - 5 .Recipient Verification and Integrity Check:
        
        Recipient uses the sender's public key to authenticate the message and then applies their private key to access the hash result and original message.
        
        The recipient independently calculates the hash of the original message and compares it with the received hash to confirm integrity.
      - 6.Advancements in Digital Signature Programs:
        
        Early digital signature systems required digital certificates and were complex. However, modern Internet-based solutions like DocuSign, Adobe Sign, and others offer simplified digital signature solutions without needing extensive software installation or understanding of digital certificate technology.
      - 7. Applications of Digital Signatures:
        
        Many sectors such as insurance, finance, and surety now allow customers to electronically sign documents using online digital signature solutions, facilitating secure and efficient transactions.
    - - 1. Computational Efficiency of Cryptographic Techniques:
        
        Public key cryptography is slow when handling large documents due to its computational demands with 128- or 256-bit keys
        
        Symmetric key cryptography is faster computationally but lacks security when transmitting keys over insecure lines.
      - 2. Solution: Digital Envelopes:
        
        To balance speed and security, a digital envelope method is employed, combining the efficiency of symmetric encryption with the security of public key cryptography
      - 3. Digital Envelope Mechanism:
        
        Involves encrypting a large document using a symmetric key for speed
        
        The symmetric key used for encryption is itself encrypted using the recipient's public key, creating a "key within a key" scenario.
      - 4. Transmission Process:
        
        The encrypted document and the digital envelope (encrypted symmetric key) are sent across the web.
      - 5. Recipient Decryption Process:
        
        Upon receipt, the recipient uses their private key to decrypt the encrypted symmetric key from the digital envelope.
        
        The decrypted symmetric key is then utilized to decrypt the main document, enabling faster encryption and decryption processes.
      - 6.Advantages:
        
        This method saves time by leveraging the faster encryption and decryption capabilities of symmetric keys while ensuring the secure transmission of the symmetric key using public key cryptography
  - - - Ensuring authenticity of individuals and institutions is crucial in digital spaces, where mere possession of a public/private key pair can't guarantee identity.
    - - Digital certificates issued by CAs validate digital identities, containing subject/company details, public keys, and CA's signature.
      - Thousands of CAs globally issue certificates forming a hierarchical network of verification.
    - - PKI includes CAs and procedures ensuring secure sites (URLs starting with "https"), indicating trust through certificates issued by trusted CAs
    - - Users generate keys, request certification from CAs, and receive unique signed certificates
      - Certificates are used for authentication in commerce, including mutual certification between customers and merchants.
    - - PKI and CAs secure software via code signing, enabling end-users to verify code integrity and developers' identities.
    - - Various browser add-ons facilitate email encryption, ensuring secure communications without extensive technical knowledge.
    - - PGP and OpenPGP serve as email encryption tools, allowing compression, encryption, and sender/recipient authentication.
  - - - PKI primarily secures messages during internet transit but fails against insider threats like authorized employees with access to sensitive data.
    - - Storage of private keys on insecure devices (desktops, laptops) poses risks of theft or loss, compromising security.
    - - Doubts exist over verifying the true user of private keys, especially when personal devices or identification papers are lost or misused.
    - - Users hold legal responsibility for actions conducted with their private keys, unlike traditional credit card dispute regulations.
    - - Certification Authorities (CAs) might lack comprehensive knowledge about certified entities, raising concerns about their authentication processes.
    - - Questions arise regarding the reliability of CA methods to identify certificate holders, sometimes relying solely on online form claims, compromising verification accuracy.
- - - - Cybersecurity Laws: Imposed by governments to protect critical infrastructure and sensitive information, requiring specific security measures and prompt reporting of data breaches
      - Consumer Protection Laws: Safeguards consumers' rights during e-commerce transactions, addressing issues like fraud, deceptive advertising, and product liability.
      - Data Protection and Privacy Laws: Compliance with laws like GDPR or CCPA for handling personal data collected during e-commerce transactions.
    - - Privacy Policy: Outlines how an organization collects, uses, stores, and protects customer information in e-commerce transactions, ensuring compliance with data protection regulations.
      - Acceptable Use Policy (AUP): Establishes rules and guidelines for the acceptable use of organizational resources in e-commerce systems.
      - Information Security Policy: Defines the organization's approach to protecting sensitive data and information assets in e-commerce. It includes data classification, access controls, encryption, and incident response.
    - - Secure Payment Processing: Implements secure payment procedures, including encrypted connections, tokenization, and compliance with PCI DSS.
      - Access Control: Restricts unauthorized access to e-commerce systems and sensitive information through authentication methods and access reviews.
      - Regular Security Assessments: Conducts periodic security assessments like vulnerability scanning and penetration testing to identify and address weaknesses in e-commerce systems.