E Commerce Security
E Commerce Security
&RESEARCH
2
Online Security Issues Overview
• Computer security
– The protection of assets from unauthorized
access, use, alteration, or destruction
• Physical security
– Includes tangible protection devices
• Logical security
– Protection of assets using nonphysical means
• Threat
– Any act or object that poses a danger to computer
assets
3
Managing Risk
• Countermeasure
– General name for a procedure that recognizes,
reduces, or eliminates a threat
• Eavesdropper
– Person or device that can listen in on and copy
Internet transmissions
• Crackers or hackers
– Write programs or manipulate technologies to
obtain unauthorized access to computers and
networks
4
5
6
Security Policy and Integrated
Security (continued)
• Elements of a security policy address:
– Authentication
– Access control
– Secrecy
– Data integrity
– Audits
7
8
9
10
11
Ensuring Transaction Integrity
with Hash Functions
• Integrity violation
– Occurs whenever a message is altered while in
transit between the sender and receiver
• Hash algorithms are one-way functions
– There is no way to transform the hash value back
to the original message
• Message digest
– Small integer number that summarizes the
encrypted information
12
13
Firewalls
• Software or hardware and software
combination installed on a network to control
packet traffic
• Provides a defense between the network to
be protected and the Internet, or other
network that could pose a threat
14
Firewalls (continued)
• Packet-filter firewalls
– Examine data flowing back and forth between a
trusted network and the Internet
• Gateway servers
– Firewalls that filter traffic based on the application
requested
• Proxy server firewalls
– Firewalls that communicate with the Internet on
the private network’s behalf
15
Summary (continued)
• Web servers are susceptible to security
threats
• Programs that run on servers might:
– Damage databases
– Abnormally terminate server software
– Make subtle changes in proprietary information
17