Electronic Commerce Online Security Issues MIS Spring 2006 Instructor: John Seydel, Ph.D.

Agenda Web page coding demonstrations and exercise Simple forms exercise Dynamic pages  Server-side scripting  Client-side scripting Other  Review guidelines for HTML source code  Forms and bulleted lists in HTML Discussions of online security issues Avery & Brawley team Avery & Brawley Additional comments Some review questions If time: HTML table basics

A Look at Dynamic versus Static Pages Login to your computer as follows: UserID = peachtree Password = accounting Domain = BU (this computer) Start the following Internet Explorer (open your SuSE1 site) SmartFTP NotePad A static page: A dynamic version: Exercises & demonstrations Forms exercise / server-side scripting demo Forms exercise / client-side scripting exercise & demo

Some Guidelines for Source Code Use lowercase for tags & attributes Quote attribute values Use relative references for resources on same server Always use closing tags Nest elements properly; close in reverse order of opening Use indentation consistently and to make code readable No more than 80 characters per line of code; break long tags into multiple lines, typically one per attribute Avoid deprecated elements, e.g., Use no spaces in file names Treat all URLs and other resource names as if case- sensitive

HTML Forms Basics At lowest level, a form consists of two elements: Form   The overall container element Input data collection control   A variety of types (textboxes, checkboxes, buttons, etc.) exist and are designated by the type attribute Example: Class: Note: several other data collection controls exist

HTML Bullet Lists Consist of two elements: Unordered list   The overall container element List item   One for each bullet point Example: My favorite schools: ASU UALR Whoever’s playing UA Lists can be nested; i.e., one list item can be another unordered list, containing its own list items (sub-bullets)

Online Security Framework Components of security Secrecy Integrity Necessity Useful for discussion/analysis at all levels Client Network Server Backend systems (e.g., database servers) Any organization must have a security policy

Security Policies Must Address: Authentication: who’s attempting access Access control: who’s allowed access Secrecy: protection of specific data Integrity: keeping the data in tact Audit: who/what causes events to occur and when?

Discussion by Avery & Brawley TeamAvery & Brawley