Chapter 19 Protecting E-Commerce systems

Is IT different? There is some discussion that IT today is no different than past enabling technologies Telegraph Electricity Rail TV Is IT becoming a commodity item?

Credit Cards Used for payment on the net In 70’s Mail Order Telephone Order (MOTO) Retailer did not have card for inspection Used expiration date as “password” Delivery to card holders address Liability fully on the merchant

Forgery Skimming Passing card through other device to capture data Can catch by looking at where card used Skimming II Do not bill for merchandise, save data use year later, no record of card being used at crooked merchant

Fraud detection Anomaly detection Travel patterns Patterns of misuse Profiling Bonuses for spotting fraud Online more difficult Based on where transaction originated from

Online Credit Card Fraud SSL makes you “feel” better Most credit card theft not “in transit” Visa guide One-time virtual card numbers

E-commerce site risks Fraud ➔ ◆ Customer uses a stolen card or account number to fraudulently purchase goods/services online. ◆ Family member uses bankcard to order goods/services online, but has not been authorized to do so. ◆ Customer falsely claims that he or she did not receive a shipment. ◆ Hackers find their way into an e-commerce merchant’s payment processing system and then issue credits to hacker card account numbers.

E-commerce site risks Account Information ➔ ◆ Hackers capture customer account data during transmission Theft (Cyber-Thieves) to/from merchant. ◆ Hackers gain access to service provider’s unprotected payment processing systems and steal cardholder account data.

E-commerce site risks Account Information ➔ ◆ Unauthorized individual accesses and steals cardholder Theft (Physical Site) data stored at merchant or service provider site and fraudulently uses or sells it for unauthorized use or identity theft purposes. ◆ Unscrupulous merchant or service provider employee steals cardholder data and fraudulently uses or sells it for unauthorized use or identity theft purposes. ◆ Dumpster-divers steal unshredded account information from trash bins at merchant or service provider location.

E-commerce site risks Customer Disputes and Charge backs ➔ ◆ Goods or services are not as described on the Website. ◆ Customer is billed before goods/services are shipped or delivered. ◆ Confusion and disagreement between customer and merchant over return and refund. ◆ Customer is billed twice for the same order and/or billed for an incorrect amount. ◆ Customer doesn’t recognize the merchant name on statement because merchant uses a service provider to handle billing.

Proper site design Credit card number only “exists” for a short period of time in an accessible location. Use of data pumps can assure it doesn’t move out to accessible location

B2B systems EDI Commercial Lack of legal documents Healthcare confidentiality

New techniques Hard to introduce For instance new payment method Merchants need equipment Customers must generate demand VHS verses Beta format Study of this in Metaverse (adopters)

IT Markets Technology high fixed cost, low marginal cost High costs to switch technologies leading to lock-in Value of product depends on how many adopt it.

Other issues Pricing Free limited version, basic service, gold premium version Free ups number using it, others make money Switching cost Monthly charges match hassle of changing Trying to achieve monopolies Microsoft passport XML makes comparison shopping BOTs easier to write Special offers, errors spread rapidly

Specific Vulnerabilities Web SQL Injection (covered) XSS (Cross Site Scripting) Not really cross site Exploits of holes in site Similar in concept to SQL injection, but inserts malicious code in variables

Articles SSL article Microsoft Passport from business perspective

Previous articles Firewall working%29 working%29 software.com/firewall_faqs/types_of_firewall.html software.com/firewall_faqs/types_of_firewall.html rewall_qa.pdf rewall_qa.pdf

Previous articles Passport Business “looks” s/articles/roi_4_intrusion.php s/articles/roi_4_intrusion.php uld+lead+to+lawsuits/ _ html uld+lead+to+lawsuits/ _ html

List of resources Credit card fraud d d MOTO trade/four/4.htm trade/four/4.htm pting_visa/ops_risk_management/visa_risk_ management_guide_ecommerce.pdf?it=sea rch pting_visa/ops_risk_management/visa_risk_ management_guide_ecommerce.pdf?it=sea rch

List or Resources Prevention p_van.htm p_van.htm Fuzz testing