Module 9 – Firewalls and Intrusion Detection Systems (IDS)
Firewalls
A firewall is a network security device that acts as a barrier between a trusted internal
network (e.g., an e-commerce company’s servers) and untrusted external networks (like
the internet). It inspects incoming and outgoing traffic and decides whether to allow or
block it based on a set of security rules.
Analogy: Imagine your e-commerce server as a shop inside a gated community. The
firewall is the security guard at the gate. Every visitor is checked — some are allowed
in, some are turned away depending on the rules (identity, purpose, behavior).
Why use Firewalls?
● Prevents unauthorized access to sensitive systems.
● Filters out malicious traffic like malware, bots, or denial-of-service attempts.
● Protects against port scanning, where hackers test open doors (ports) into the
network.
● Essential for compliance — many regulations (like PCI-DSS for payment data)
require firewalls.
Advantages of Firewalls in E-Commerce:
1. Acts as the first line of defense against hackers.
2. Provides control over traffic, ensuring only legitimate users reach the application.
3. Stops many automated attacks before they reach deeper systems.
4. Can be customized — e.g., Web Application Firewalls (WAFs) protect against
SQL injections and cross-site scripting, common attacks on e-commerce
platforms.
Threats prevented by firewalls in e-commerce:
● Hackers scanning Amazon or Flipkart servers for vulnerabilities.
● DDoS (Distributed Denial of Service) floods trying to overwhelm a shopping site
during festive sales.
● Bots scraping product prices or stealing discount codes.
Intrusion Detection Systems (IDS)
An Intrusion Detection System (IDS) is a security tool that continuously monitors
network or system activities to identify suspicious or malicious behavior. Unlike firewalls
(which block traffic at the gate), IDS is like a CCTV camera and alarm system inside the
house — it watches what’s happening inside and alerts when something unusual
occurs.
Definition: IDS compares current activity against known attack patterns or behavioral
baselines and raises alerts when threats are detected.
Why use IDS?
● Detects internal threats or attacks that firewalls miss (e.g., if an attacker already
got inside).
● Identifies advanced persistent threats (APTs) where attackers slowly steal data
over time.
● Provides logs and forensic evidence for investigating cyber incidents.
Types of IDS:
● Network-based IDS (NIDS): Watches traffic across the whole network.
● Host-based IDS (HIDS): Monitors activity on specific servers (e.g., a payment
server).
Advantages of IDS in E-Commerce:
1. Provides early warning of sophisticated intrusions.
2. Helps in identifying insider threats (e.g., an employee misusing access).
3. Detects unusual behavior like thousands of failed login attempts (brute-force
attacks).
4. Complements firewalls by catching what slips through.
Threats detected by IDS in e-commerce:
● Attackers trying to inject malicious code into Flipkart’s database.
● Brute-force attempts to guess Amazon customer passwords.
● Malware-infected servers trying to send out stolen credit card data.
Firewalls and IDS Together
In a secure e-commerce network, both systems complement each other:
● Firewalls block suspicious outsiders from entering.
● IDS monitors activity inside to ensure no intruder is misbehaving.
Analogy: In a shopping mall, the firewall is the guard at the entrance, while IDS is the
surveillance camera system inside. Without the guard, anyone could walk in. Without
the cameras, you wouldn’t notice if someone shoplifted or broke into a store.
Case Study: The Target Data Breach (2013)
Target, one of the largest retail chains in the United States, became
infamous in 2013 for suffering one of the most devastating cyberattacks in
retail history. The breach exposed payment card information of more than
40 million customers and personal details (names, addresses, phone
numbers, emails) of an additional 70 million people. The incident not only
shook consumer trust but also became a landmark case in discussions
about corporate cybersecurity.
The attack began in a way that highlights the interconnected nature of
modern businesses. Hackers gained access not by directly attacking
Target’s primary systems but through a third-party HVAC contractor that
handled air conditioning and refrigeration services. The contractor had
remote access to parts of Target’s network for billing and project
management purposes. Unfortunately, their security was weak, and
attackers stole the contractor’s credentials using a phishing email. With
these credentials, the hackers gained entry into Target’s internal network.
Once inside, the attackers moved laterally across the network, carefully
avoiding detection. They installed malware on Target’s point-of-sale (POS)
terminals, the very machines where customers swiped their credit and debit
cards. The malware was programmed to capture card details — numbers,
expiration dates, and CVV codes — as soon as they were entered. Over
several weeks, this sensitive information was funneled to external servers
controlled by the attackers, eventually reaching black markets where it was
sold for profit.
What makes this case particularly striking is that Target had security tools
in place. The company had deployed firewalls to filter traffic and an
Intrusion Detection System (IDS) from a well-known vendor. In fact, the IDS
did detect suspicious activity. It flagged unusual data transfers leaving the
network and raised multiple alerts. However, Target’s security team failed to
act on these warnings, dismissing them as false positives. In other words,
the technology worked, but human oversight failed.
The fallout was massive. Target faced financial losses exceeding $200
million, not only from compensating banks and customers but also from
lawsuits and regulatory fines. Several senior executives, including the CIO
and later the CEO, resigned in the aftermath. More importantly, customers
lost trust in the brand, and sales during the holiday season — a crucial
period for retailers — dropped significantly.
The breach forced Target to rethink its approach to cybersecurity. The
company invested heavily in next-generation firewalls, advanced IDS/IPS
(Intrusion Prevention Systems), and real-time monitoring teams to ensure
alerts were not ignored. They also implemented stricter controls for
third-party vendors, recognizing that supply chain security is as important
as securing internal systems.
For students of e-commerce security, the Target case is a powerful
reminder that firewalls and IDS are not optional extras — they are
essential. But even more importantly, they only work when businesses
actively monitor, interpret, and act on the intelligence these systems
provide. Cybersecurity is not just about having tools in place; it is about
how effectively those tools are used.
Discussion Questions
1. Define a firewall and explain how it protects e-commerce platforms from cyber
threats.
2. How does IDS differ from a firewall, and why are both necessary in an
e-commerce security framework?
3. In the Target breach, attackers bypassed the firewall using legitimate vendor
credentials. How could IDS have helped if the alerts were taken seriously?
4. What lessons can small e-commerce startups learn from Target’s experience
about balancing technology and human response in cybersecurity?