Security of E-commerce

What is computer security?? Computer security in general refers to the protection of data, networks, computer programs, computer power, and other elements of computerized information systems.

What is EC Security?? EC Security involves: -prevention, or at least minimization of the web attacks -encryption of information -protection of users (customers, visitors, byers)

Security risks 2014 and 2015 (IBM, 2014) Cyberespionage and cyberwars are growing threats. Attacks are now also against mobile assets, including on smartphones, tablets, and other mobile devices. Enterprise mobile devices are a particular target. Attacks on social networks and social software tools. User-generated content is a major source of malware. Attacks on BYOD (“Bring Your Own Device”). Identity theft is exploding, increasing the criminal use of the stolen identities. Profit motive – as long as cybercriminals can make money, security threats and phishing attacks, will continue to grow. Social engineering tools such as phishing via e-mail are growing rapidly. Cybergang consolidation – underground groups are multiplying and getting bigger, especially in Internet fraud and cyberwars. Business-oriented spam (including imagebased spam). Attacks using spyware (e.g., using Denial-of- Service method). Attacks on new technologies such as cloud computing and virtualization. Attacks on Web and mobile applications (apps).

TYPES OF ATTACKS Cyber attacks can be classified into two major interrelated categories: Corporate espionage. Many attacks target energy-related companies because their inside information is valuable (McAfee 2011 ) Political espionage and warfare. Political espionage and cyberwars are increasing in magnitude.

EC Security Requirements Authentication is a process used to verify (assure) the real identity of an EC entity, which could be an individual, software agent, computer program, or EC website. Authorization is the provision of permission to an authenticated person to access systems and perform certain operations in those specific systems. Auditing. When a person or program accesses a website or queries a database, various pieces of information are recorded or logged into a file. The process of maintaining or revisiting the sequence of events during the transaction, when,and by whom, is known as auditing.

Availability. Assuring that systems and information are available to the user when needed Nonrepudiation. Closely associated with authentication is nonrepudiation , which is the assurance that online customers or trading partners will not be able to falsely deny (repudiate) their purchase, transaction, sale,

Factors that convert consumers who browse online into consumers who buy online: security price comparative information searchability ease of ordering delivery time product presentation

Possible threats hacking viruses denial of service

Security is complex problem Communication HW SW Security Procceses Personal (internal and external employees, hackers) Physical (fire, water…)

Software and hardware security

Technical security attack methods Malware Unauthorized access Denial of Service Spam and spyware Hijacking servers Botnets (malicious SW to hijack number of different computers) Maladvertising

Non-technical threats Phishing is a fraudulent process of acquiring confi dential information, such as credit card or banking details, from unsuspecting computer users. Pharming. Similarly to phishing, pharming is a scam where malicious code is installed on a computer and used to redirect victims to a bogus websites without their knowledge or consent

security and privacy elements Authenticity Integrity Non-repudiation Auditing Confidentiality Availability

The methods by which a human can authenticate Something the user is (e.g., fingerprint or retinal pattern, DNA sequence (there are assorted definitions of what is sufficient), voice pattern (again several definitions), signature recognition or other biometric identifier) Something the user has (e.g., ID card, security token, software token or cell phone) (e.g. Digipass from VASCO, or RSA) Something the user knows (e.g., a password, a pass phrase or a personal identification number (PIN))

Example of security card and key

Methods Cryptography or cryptology is a field of mathematics and computer science concerned with information security and related issues, particularly encryption and authentication.

Encryption Decryption obtained message transfered message plain message encrypted message nosy parker decryption encryption

The Ancient Greek scytale may have been one of the earliest devices used to implement a cipher.

The Enigma machine, used by Germany in World War II, implemented a complex cipher to protect sensitive communications.

Modern cryptography Symmetric-key cryptography Public-key cryptography

Symmetric-key cryptography Symmetric-key algorithms are a class of algorithms for cryptography that use trivially related cryptographic keys for both decryption and encryption

SYMMETRIC KEY ENCRYPTION

Public-key cryptography Public key cryptography is a form of cryptography which generally allows users to communicate securely without having prior access to a shared secret key. This is done by using a pair of cryptographic keys, designated as public key and private key, which are related mathematically

digital signatures secret key Original text hash function signed document

Creating and veryfing a digital signature: encrypt digital signature + plain message using recipients public key Plain message Create digest (hash) from message Transmit through internet Digest Encrypt digets using senders private key Decrypt encrypted digital signature and encrypted message using recipients private key Digital signature Plain message Digital signature Dencrypt digital siganature using senders public key Create digest (hash) from message Digest Digest

In cryptography, a certificate authority or certification authority (CA) is an entity which issues digital certificates for use by other parties. It is an example of a trusted third party. CA's are characteristic of many public key infrastructure (PKI) schemes