Security Unit 1 Business skills for e-commerce HND in Computing and Systems Development

Timeline Week Activity 1 Introduction & Businesses 10 Assignment 2 LO2 LO1 Stakeholders 11 LO3 Key processes 3 LO1 Functions 12 LO3 e-commerce 4 13 LO3 Security - 1 5 LO2 Impacts 14 LO3 Security - 2 6 Assignment 1 LO1 15 LO3 Legislation 7 LO3Target markets 16 Assignment 3 LO3 issued 8 LO3 Objectives 17 Assignment work 9 LO3 Market research 18

LO3: Be able to design e-Commerce solutions Objectives: business idea eg unique selling proposition, business-to-business opportunities, business to consumer markets; domain name Market research: purpose of research eg identifying information sources, online and offline competition; types of research eg primary, secondary Target markets: market analysis eg size, characteristics, dynamics, competitors, historical background, emerging trends, market share, market segmentation Key processes: technology requirements eg hardware, software, security, maintenance, back end systems; supply sources; distribution channels e-Commerce: payment systems eg electronic cheque, PayPal, NoChex, credit or debit cards; start-up capital; working capital; funding sources Security: key areas eg prevention of hacking, viruses, identity theft, firewall, impact on site performance, Secure Sockets Layer (SSL), Secure HTTP (HTTPS), digital certificates, strong passwords, alternative authentication methods Legislation: relevant legislation eg Data Protection Act 1998, Computer Misuse Act 1990, Consumer Credit Act 1974, Trading Standards, Freedom of Information Act 2000, copyright legislation

LO3 Criteria 3.1 investigate market potential for an e-Commerce opportunity 3.2 evaluate current e-Commerce systems in use by organisations 3.3 discuss the financial implications of an e-Commerce solution 3.4 design an e-Commerce solution 3.5 evaluate the suitability of an e-Commerce solution.

Participants Customer Merchant Software vendor Attacker Purchases the products or services Merchant Owns or leases the ecommerce systems Software vendor Supplies the software to run the systems Attacker Exploits the other three for illegitimate gains

Points of attack The customer The customer’s computer Network connection between the customer’s computer and the merchant’s server The merchant The web site’s server The software vendor

Attacks Tricking the customer Calling and extracting information, then using it to con the merchant Phishing False web sites linked from emails or registered URL typos eg applr.com

Customers computers Port scanning Keystroke loggers nmap – a security scanner used to discover hosts and services on a computer network Keystroke loggers Distributed by virus, worm or Trojan

Network attacks IP address spoofing Packet sniffing Pretending to be a legitimate PC on a LAN or WAN Packet sniffing Detecting unencrypted or poorly protected wireless traffic False wi-fi hotspots

Fraud Chargeback fraud Stolen cards Identity theft Claiming delivered goods were never received Stolen cards Identity theft Falsely authenticating with stolen or faked documents to create accounts

Web server attacks Password guessing Denial of service (DOS) Manual or automated using common passwords or rainbow tables (reverse encrypted lookups) Denial of service (DOS) Pings of death, ping flood, botnets

Software vulnerabilities Buffer overflow attacks Poor code opens a vulnerability with root access SQL injection Malicious SQL statements inserted Cross site scripting Malicious scripts inserted in legitimate web sites

Exploit tools SAINT exploit tools penetration test servers (but do not exploit them) Examples are Chrome password grabber OSX 10.7 User name and hash grabber Reverse shell applet – delivers a signed Java applet ARP spoof tool for man in the middle attacks Automatic drive by download Flash drive trojan that opens connections when run by Autoplay or Open Folder

Defences Choose a secure ecommerce platform Use SSL security PCI (Payment Card Industry) compliant Run regular PCI audit scans Use SSL security Trusted certificates Encrypted connections Even better, use EVSSL More extensive vetting before issuing certificates Green in URL address bar in browser

Defences Firewalls Inspect incoming and outgoing packets to make sure the source or destination addresses are legitimate – packet filtering Statefull – is a packet part of a legitimate connection? Application layer – detects illegitimate protocol or port usage

UTM (unified threat management network firewalling network intrusion prevention gateway antivirus (AV) gateway anti-spam VPN content filtering load balancing data leak prevention on-appliance reporting

Sensible precautions Don’t store credit card details Use an address verification and card verification service Enforce strong passwords Detect suspicious activity Software available Use tracking for delivery of all orders Apply all patches and updates Have a sound backup

Activity Match the threats to the defences Determine what the correct defence is for each threat Determine what security measures are appropriate for an SME ecommerce business Local defences Hosted defences Services that can be used