Chapter 5

E-commerce Security and Payment Systems

Copyright © 2016 Pearson Education, Ltd.

 Class Discussion

Cyberwar: MAD 2.0

 What is the difference between hacking and
cyberwar?
 Why has cyberwar become more potentially
devastating in the past decade?
 Is it possible to find a political solution to
MAD 2.0?
 What issues do programs like MonsterMind
and Plan X pose?

Copyright © 2016 Pearson Education, Ltd. Slide 1-2

 The E-commerce Security
Environment
 Overall size and losses of cybercrime
unclear
 Reporting issues

 2013 survey: Average annualized cost of

cybercrime was $11.56 million/year
 Underground economy marketplace:
 Stolen information stored on underground
economy servers

Copyright © 2016 Pearson Education, Ltd. Slide 1-3

 What Is Good E-commerce Security?
 To achieve highest degree of security
 New technologies
 Organizational policies and procedures
 Industry standards and government laws

 Other factors
 Time value of money
 Cost of security vs. potential loss
 Security often breaks at weakest link

Copyright © 2016 Pearson Education, Ltd. Slide 1-4

 The E-commerce Security Environment

Figure 4.1, Page 242

Copyright © 2016 Pearson Education, Ltd. Slide 5-5

Table 4.3, Page 244

Copyright © 2016 Pearson Education, Ltd. Slide 5-6

 The Tension Between Security and
Other Values
 Ease of use
 The more security measures added, the more
difficult a site is to use, and the slower it
becomes
 Public safety and criminal uses of the
Internet
 Use of technology by criminals to plan crimes or
threaten nation-state

Copyright © 2016 Pearson Education, Ltd. Slide 1-7

 Security Threats in the
E-commerce Environment
 Three key points of vulnerability in
e-commerce environment:
1. Client
2. Server
3. Communications pipeline (Internet
communications channels)

Copyright © 2016 Pearson Education, Ltd. Slide 1-8

 A Typical E-commerce Transaction

Figure 4.2, Page 246

Copyright © 2016 Pearson Education, Ltd. Slide 5-9

 Vulnerable Points in an E-commerce
Transaction

Figure 4.3, Page 247

Copyright © 2016 Pearson Education, Ltd. Slide 5-10

Most Common Security Threats in the

 E-commerce
Malicious Environment
code (malware) – threat at both client
and server level
 Exploits and exploit kits
 Drive-by downloads
 Viruses
 Worms
 Ransomware
 Trojan horses
 Backdoors
 Bots, botnets

Copyright © 2016 Pearson Education, Ltd. Slide 1-11

 Most Common Security Threats (cont.)
 Potentially unwanted programs (PUPs)
 Browser parasites
 Adware
 Spyware

 Phishing
 Social engineering
 E-mail scams
 Spear phishing
 Identity fraud/theft

Copyright © 2016 Pearson Education, Ltd. Slide 1-12

 Most Common Security Threats (cont.)
 Hacking
 Hackers vs. crackers
 Types of hackers: White, black, grey hats
 Hacktivism

 Cybervandalism:
 Disrupting, defacing, destroying Web site

 Data breach
 Losing control over corporate information to
outsiders

Copyright © 2016 Pearson Education, Ltd. Slide 1-13

 Insight on Business: Class Discussion

Hackers Infiltrate Target

 What organizational and technological
failures led to the data breach at
Target?
 What technical solutions are available to
combat data breaches?
 Have you or anyone you know
experienced a data breach?

Copyright © 2016 Pearson Education, Ltd. Slide 1-14

 Most Common Security Threats (cont.)
 Credit card fraud/theft
 Identity fraud/theft
 Spoofing
 Pharming
 Spam (junk) Web sites
 Link farms

 Denial of service (DoS) attack

 Site flooded with useless traffic to overwhelm network
 Distributed denial of service (DDoS) attack

Copyright © 2016 Pearson Education, Ltd. Slide 1-15

 Most Common Security Threats (cont.)
 Sniffing
 Eavesdropping program that monitors information
traveling over a network
 Insider attacks
 Poorly designed software
 Social network security issues
 Mobile platform security issues
 Vishing, smishing, madware

 Cloud security issues

Copyright © 2016 Pearson Education, Ltd. Slide 1-16

 Insight on Technology: Class Discussion

Think Your Smartphone Is Secure?

 What types of threats do smartphones face?
 Are there any particular vulnerabilities to this
type of device?
 What did Nicolas Seriot’s “Spyphone” prove?
 Are apps more or less likely to be subject to
threats than traditional PC software
programs?

Copyright © 2016 Pearson Education, Ltd. Slide 1-17

 Technology Solutions
 Protecting Internet communications
 Cryptography

 Securing channels of communication

 SSL, TLS, VPNs, Wi-Fi

 Protecting networks
 Firewalls, proxy servers, IDS, IPS

 Protecting servers and clients

 OS security, anti-virus

Copyright © 2016 Pearson Education, Ltd. Slide 1-18

 Tools Available to Achieve Site Security

Figure 4.5, Page 267

Copyright © 2016 Pearson Education, Ltd. Slide 5-19

 Encryption
 Encryption
 Transforms data into cipher text readable only by
sender and receiver
 Secures stored information and information
transmission
 Provides 4 of 6 key dimensions of e-commerce security:
 Message integrity
 Nonrepudiation
 Authentication
 Confidentiality

Copyright © 2016 Pearson Education, Ltd. Slide 1-20

 Symmetric Key Cryptography
 Sender and receiver use same digital key to encrypt
and decrypt message
 Requires different set of keys for each transaction
 Strength of encryption
 Length of binary key used to encrypt data
 Data Encryption Standard (DES)
 Advanced Encryption Standard (AES)
 Most widely used symmetric key algorithm
 Uses 128-, 192-, and 256-bit encryption keys
 Other standards use keys with up to 2,048 bits

Copyright © 2016 Pearson Education, Ltd. Slide 1-21

 Public Key Cryptography
 Uses two mathematically related digital keys
 Public key (widely disseminated)
 Private key (kept secret by owner)

 Both keys used to encrypt and decrypt message

 Once key used to encrypt message, same key
cannot be used to decrypt message
 Sender uses recipient’s public key to encrypt
message; recipient uses private key to decrypt it

Copyright © 2016 Pearson Education, Ltd. Slide 1-22

 Public Key Cryptography: A Simple Case

Figure 4.6, Page 271

Copyright © 2016 Pearson Education, Ltd. Slide 5-23

 Public Key Cryptography using Digital
Signatures and Hash Digests
 Hash function:
 Mathematical algorithm that produces fixed-length number called
message or hash digest
 Hash digest of message sent to recipient along with
message to verify integrity
 Hash digest and message encrypted with recipient’s
public key
 Entire cipher text then encrypted with recipient’s
private key—creating digital signature—for
authenticity, nonrepudiation

Copyright © 2016 Pearson Education, Ltd. Slide 1-24

 Public Key Cryptography with Digital
Signatures

Figure 4.7, Page 272

Copyright © 2016 Pearson Education, Ltd. Slide 5-25

 Digital Envelopes
 Address weaknesses of:
 Public key cryptography
 Computationally slow, decreased transmission speed, increased
processing time
 Symmetric key cryptography
 Insecure transmission lines
 Uses symmetric key cryptography to encrypt
document
 Uses public key cryptography to encrypt and
send symmetric key

Copyright © 2016 Pearson Education, Ltd. Slide 1-26

 Creating a Digital Envelope

Figure 4.8, Page 273

Copyright © 2016 Pearson Education, Ltd. Slide 5-27

 Digital Certificates and
Public Key Infrastructure (PKI)
 Digital certificate includes:
 Name of subject/company
 Subject’s public key
 Digital certificate serial number
 Expiration date, issuance date
 Digital signature of CA

 Public Key Infrastructure (PKI):

 CAs and digital certificate procedures
 PGP

Copyright © 2016 Pearson Education, Ltd. Slide 1-28

 Digital Certificates and Certification
Authorities

Figure 4.9, Page 274

Copyright © 2016 Pearson Education, Ltd. Slide 5-29

 Limits to Encryption Solutions
 Doesn’t protect storage of private key
 PKI not effective against insiders, employees
 Protection of private keys by individuals may be
haphazard
 No guarantee that verifying computer of
merchant is secure
 CAs are unregulated, self-selecting
organizations

Copyright © 2016 Pearson Education, Ltd. Slide 1-30

 Securing Channels of Communication
 Secure Sockets Layer (SSL)/Transport Layer
Security (TLS)
 Establishes secure, negotiated client–server session

 Virtual Private Network (VPN)

 Allows remote users to securely access internal
network via the Internet
 Wireless (Wi-Fi) networks
 WPA2

Copyright © 2016 Pearson Education, Ltd. Slide 1-31

Secure Negotiated Sessions Using SSL/TLS

Figure 4.10, Page 277

Copyright © 2016 Pearson Education, Ltd. Slide 5-32

 Protecting Networks
 Firewall
 Hardware or software that uses security policy to filter
packets
 Packet filters
 Application gateways
 Next-generation firewalls

 Proxy servers (proxies)

 Software servers that handle all communications from or
sent to the Internet
 Intrusion detection systems
 Intrusion prevention systems

Copyright © 2016 Pearson Education, Ltd. Slide 1-33

 Firewalls and Proxy Servers

Figure 4.11, Page 280

Copyright © 2016 Pearson Education, Ltd. Slide 5-34

 Protecting Servers and Clients
 Operating system security
enhancements
 Upgrades, patches

 Anti-virus software
 Easiest and least expensive way to prevent
threats to system integrity
 Requires daily updates

Copyright © 2016 Pearson Education, Ltd. Slide 1-35

 Management Policies, Business
Procedures, and Public Laws
 Worldwide, companies spend more than
$81 billion on security hardware,
software, services
 Managing risk includes:
 Technology
 Effective management policies
 Public laws and active enforcement

Copyright © 2016 Pearson Education, Ltd. Slide 1-36

A Security Plan: Management Policies
 Risk assessment
 Security policy
 Implementation plan
 Security organization
 Access controls
 Authentication procedures, including biometrics
 Authorization policies, authorization management
systems
 Security audit

Copyright © 2016 Pearson Education, Ltd. Slide 1-37

 Developing an E-commerce Security Plan

Figure 4.12, Page 283

Copyright © 2016 Pearson Education, Ltd. Slide 5-38

 The Role of Laws and Public Policy
 Laws that give authorities tools for identifying,
tracing, prosecuting cybercriminals:
 USA Patriot Act
 Homeland Security Act
 Private and private-public cooperation
 US-CERT
 CERT Coordination Center
 Government policies and controls on encryption
software
 OECD, G7/G8, Council of Europe, Wassener Arrangement

Copyright © 2016 Pearson Education, Ltd. Slide 1-39

 E-commerce Payment Systems
 Credit cards
 46% of online payments in 2014 (United States)

 Debit cards
 32% online payments in 2014 (United States)

 Limitations of online credit card payment

 Security, merchant risk
 Cost
 Social equity

Copyright © 2016 Pearson Education, Ltd. Slide 1-40

 How an Online Credit Transaction Works

Figure 4.15, Page 290

Copyright © 2016 Pearson Education, Ltd. Slide 5-41

 Alternative Online Payment Systems
 Online stored value systems:
 Based on value stored in a consumer’s bank,
checking, or credit card account
 Example: PayPal

 Other alternatives:
 Amazon Payments
 Google Wallet
 Bill Me Later
 WUPay, Dwolla, Stripe

Copyright © 2016 Pearson Education, Ltd. Slide 1-42

 Mobile Payment Systems
 Use of mobile phones as payment devices
established in Europe and Asia
 Near field communication (NFC)
 Short-range (2”) wireless for sharing data between
devices
 Expanding in United States
 Apple Pay
 PayPal
 Square
 Google Wallet

Copyright © 2016 Pearson Education, Ltd. Slide 1-43

 Digital Cash and Virtual Currencies
 Digital cash
 Based on algorithm that generates unique
tokens that can be used in “real” world
 Example: Bitcoin

 Virtual currencies
 Circulate within internal virtual world
 Example: Linden Dollars in Second Life,
Facebook Credits

Copyright © 2016 Pearson Education, Ltd. Slide 1-44

 Insight on Society: Class Discussion

Bitcoin
 What are some of the benefits of using a
digital currency?
 What are the risks involved to the user?
 What are the political and economic
repercussions of a digital currency?
 Have you or anyone you know ever used
Bitcoin?

Copyright © 2016 Pearson Education, Ltd. Slide 1-45

 Electronic Billing Presentment and
Payment (EBPP)
 Online payment systems for monthly bills
 Over 50% of all bill payments
 Two competing EBPP business models:
 Biller-direct (dominant model)
 Consolidator

 Both models are supported by EBPP

infrastructure providers

Copyright © 2016 Pearson Education, Ltd. Slide 1-46

Copyright © 2016 Pearson Education, Ltd. Slide 1-47
Copyright © 2016 Pearson Education, Ltd. Slide 1-48
Copyright © 2016 Pearson Education, Ltd. Slide 1-49
Copyright © 2016 Pearson Education, Ltd. Slide 1-50
Copyright © 2016 Pearson Education, Ltd. Slide 1-51
Copyright © 2016 Pearson Education, Ltd. Slide 1-52
Copyright © 2016 Pearson Education, Ltd. Slide 1-53
Copyright © 2016 Pearson Education, Ltd. Slide 1-54
Copyright © 2016 Pearson Education, Ltd. Slide 1-55
Copyright © 2016 Pearson Education, Ltd. Slide 1-56
Copyright © 2016 Pearson Education, Ltd. Slide 1-57
Copyright © 2016 Pearson Education, Ltd. Slide 1-58
Copyright © 2016 Pearson Education, Ltd. Slide 1-59
Copyright © 2016 Pearson Education, Ltd. Slide 1-60
Copyright © 2016 Pearson Education, Ltd. Slide 1-61