Key Concept Chapter 10 – Electronic Commerce Security

In the late 1970s, the Defense Department formed a committee to develop computer security guidelines for handling classified info on computers- Trusted Computer System Evaluation Criteria.-spelled out rules for mandatory access control.

Online Security Issues Overview
-Computer security is the protection of assets from unauthorized access, use, alteration, or destruction-two general types of security: physical and logical. Physical security includes tangible protection devices, such as alarms, guards, fireproof doors, security defenses. Protection of assets using nonphysical means is called logical security. Any act or object that poses a danger to computer assets is known as a threat.
-Countermeasure is the general name for a procedure, either physical or logical, that reduces, or eliminates a threat. There are four general actions that an organization could take, depending on the impact (cost) and the probability of the physical threat: Contain and control, Prevent, Insurance or backup plan, Ignore.
-An eavesdropper is a person or device that can listen in on and copy internet transmissions. People who write programs or manipulate technologies to obtain unauthorized access to computers and networks are called crackers/hackers.
-Computer security is generally classified into three categories: secrecy, integrity, and necessity.
-A security policy is a written statement describing which assets to protect and why they are being protected, who is responsible for that protection, and which behaviours are acceptable and which aren’t. The policy primarily addresses physical security, network security, access authorizations, virus protection, and disaster recovery. Minimum level of acceptable security for most electronic commerce operations:
Secrecy: prevent unauthorized persons from reading messages and business plans, obtaining credit card numbers, or deriving other confidential info; Integrity: enclose info in a digital envelope so that the computer can automatically detect messages that have been altered in transit; Availability: provide delivery assurance for each message segment so that messages or message segments cannot be lost undetectably; Key management: provide secure distribution and management of keys needed to provide secure communications; Nonrepudiation: provide undeniable, end to end proof of each message’s origin and recipient; Authentication: securely identify clients and servers with digital signatures and certificates.
A security policy covers many security concerns that must be addressed by a comprehensive and integrated security plans: Authentication: who is trying to access the e-commerce site; Access control: who is allowed to log on to and access the e-commerce site; Secrecy: who is permitted to view selected information; Data integrity: who is allowed to change data; Audit: who or what causes specific events to occur, and when

Security for client computers
Cookies-The internet provides a type of connection between web clients and servers called a stateless connection. In a stateless connection, each transmission of info is independent, that is, no continuous connection (also called an open session) is maintained between any client and server on the internet. Cookies are small text files that web servers place on web client computers to identify returning visitors. Also allow web servers to maintain continuing open sessions with web clients. Cookies were invented to solve the stateless connection problem by saving info about a web user from one set of server client message exchanges to another. Two ways of categorizing cookies: by time duration and by source. Time duration cookie categories include: session cookies which exist until the web client ends the connection (or session) and persistent cookies which remain on the client computer indefinitely. Another way of categorizing cookies is by their source. Cookies can be placed on the client computer by the web server site, in which case they are called first party cookies, or cookies. A third party cookie originates on a web site other than the site being visited.
Web bugs- a tiny graphic that a third party web site places on another site’s web page. When a site visitor loads the web page, the web bug is delivered by the third-party site, which can then place a cookie on the visitor’s computer. A web bug’s only purpose is to provide a way for a third party web site to place cookies from that third party site on the visitor’s computer.
Active content refers to programs that are embedded transparently in web pages and that cause action to occur-can display moving graphics, download and play audio, or implement web based spreadsheet programs. An applet is a small application program. Because active content modules are embedded in web pages, they can be completely transparent to anyone browsing a page containing them. A Trojan horse is a program hidden inside another program or web page that masks its true purpose. Zombies are equally threatening-it is a Trojan horse that secretly takes over another computer for the purpose of launching attacks on other computers. Zombie attacks can be very difficult to trace.
Java Applets-The web server sends the Java applets along with web pages requested by the web client. In most cases, the Java applet’s operation will be visible to the site visitor, however, it is possible for a Java applet to perform functions that would not be noticed by the site visitor. Java is platform independent, it can run on many different computers. Once downloaded, embedded Java code can run on a client’s computer, which means that security violations can occur. Untrusted Java applets are those that have not been established as secure.
JavaScript is a scripting language developed by Netscape to enable Web page designers to build active content. When a user downloads a web page with embedded Java Script code, it executes o the user’s (client) computer. Like other active content vehicles, JavaScript can be used for attacks by executing code that destroys the client’s hard disk, discloses the email stored in client mailboxes, etc. JavaScript code can also record the URLS of web pages a user visits and capture info entered into web forms. Unlike Java applets, a Java Script program cannot commence on its own.
An ActiveX control is an object that contains programs and properties that web designers place on web pages to perform particular tasks. ActiveX controls run only on computers with windows operating systems. The security danger with Active X controls is that once they are downloaded, they execute like any other program on a client computer-full access to all system resources.
Graphics and Plug Ins-Some graphics file formats have been designed specifically to contain instructions on how to render a graphic. That means that any web page containing such a graphic could be a threat because the code embedded in the graphic could cause harm to a client computer-browser plug ins, which are programs that enhance the capabilities of browsers, handle web content that a browser cannot handle-perform tasks for a browser, such as playing audio clips, displaying movies, or animating graphics. Pose security threats-users download these plug in programs and install them so their browsers can display content that cannot be included in HTML tags. Viruses, worms, and antivirus software-A virus is software that attaches itself to another program and can cause damage when the host program is activated. A worm is a type of virus that replicates itself on the computers that it infects. A macro virus is a type of virus that is coded as a small program, called a macro, and is embedded in a file. Multivector virus-can enter a computer system in several different ways (vectors).
Digital Certificates- way to control threats from active content is to use digital certificates- an attachment to an email message or a program embedded in a web page that verifies that the sender or web site is who or what it claims to be. It contains a means to send an encrypted message-encoded so other cannot read it-to the entity that sent the original web page or email message. Digital certificates are issued by a certification authority (CA)- requires entities applying for digital certificates to supply appropriate proof of identity.
A key is simply a number used with the encryption algorithm to lock the characters of the message being protected so that they are undecipherable without the key.
Steganography-process of hiding info within another piece of info. This other info resides in the background and is undetectable by anyone without the correct decoding software. A way of hiding an encrypted file within another file so that a casual observer cannot detect that there is anything of importance in the container file. In this two step process, encrypting the file protects it form being read, and steganography makes it invisible.

Communication Channel security
-Secrecy is the prevention of unauthorized info disclosure. Privacy is the protection of individual rights to nondisclosure. Software applications called sniffer programs provide the means to record info that passes through a computer or router that is handling internet traffic.
-An integrity threat, also known as active wiretapping, exists when an unauthorized party can alter a message stream of info. Unlike secrecy threats, where a viewer simply sees info he or she should not, integrity threats can cause a change in the actions a person or corporation takes because a mission critical transmission has been altered. Cybervandalism is the electronic defacing of an existing web site’s page. The electronic equivalent of destroying property or placing graffiti on objects, cybervandalism occurs whenever someone replaces a web site’s regular content with his or her own content. Masquerading or spoofing pretending to be someone you are not, or representing a web site as an original when it is a fake-is one means of disrupting web sites. Domain name servers (DNSs) are the computers on the internet that maintain directories that link domain names to IP addresses.
-The purpose of a necessity threat, also known by other names such as a delay, denial, or denial of service threat, is to disrupt normal computer processing, or deny processing entirely.
Threats to wireless networks-If not protected, a wireless network allows anyone within that range to log in and have access to any resources connected to that network. The security of the connection depends on the Wireless Encryption Protocol (WEP), which is a set of rules for encrypting transmissions from the wireless devices to the WAPs. Attackers-wardrivers, warchalking.
-Encryption is the coding of info by using a mathematically based program and a secret key to produce a strong of characters that is unintelligible. The science that studies encryption is called cryptography- the science of creating messages that only the sender and receiver can read. Cryptography is different from steganography, which makes text undetectable to the naked eye. Cryptography doesn’t hide text; it convents it to other text that is visible, but doesn’t appear to have any meaning.
Encryption Algorithms: the program that transforms normal text, called plain text, into cipher text (the unintelligible string of characters) is called an encryption program. The logic behind an encryption program that includes the mathematics used to do the transformation-is called an encryption algorithm. Hash coding is a process that uses a hash algorithm to calculate a number, called a hash value, from a message of any length. It is a fingerprint for the message because it is almost certain to be unique for each message. Asymmetric encryption or public key encryption, encodes messages by using two mathematically related numeric keys. One key of the pair, called a public key, is freely distributed to the public at large- to anyone interested in communicating securely with the holder of both keys. The public key is used to encrypt messages using one of several different encryption algorithms. The second key-called a private key-belongs to the key owner, who keeps the key secret. The owner uses the private key to decrypt all messages received. One of the most popular technologies used to implement public key encryption today is called Pretty Good Privacy (PGP). PGP is a set of software tools that can use several different encryption algorithms to perform public key encryption. Symmetric encryption, also known as private key encryption, encodes a message with one of several available algorithms that use a single numeric key to encode and decode data. Because the same key is used, both the message sender and the message receiver must known the key-very fast and efficient.
-Comparing Asymmetric and Symmetric Encryption Systems: Public key (asymmetric) systems provide several advantages over private key (symmetric) encrpyion methods. First, the combination of keys required to provide private messages between enormous numbers of people is small. If n people want to share secret info with one another, then only n unique public key pairs are required – far fewer than an equivalent private key system. Second, key distribution isn’t a problem. Each person’s public key can be posted anywhere and doesn’t require any special handling to distribute. Third, public key systems make implementation of digital signatures possible. Public key systems have disadvantages. One disadvantage is that public key encryption and decryption are significantly slower than private key systems. Don’t replace private key systems, but serve as a complement to them.
-Secure Sockets Layer (SSL) Protocol: SSL provides a security “handshake” in which the client and server computers exchange a brief burst of messages. In those messages, the level of security to be used for exchange of digital certificates and other tasks is agreed upon. Each computer identifies the other. After identification, SSL encrypts and decrypts info flowing between the two computers. Info in both the HTTP request and any HTTP response is encrypted. Secure Sockets Layer allows the length of the private session key generated by every encrypted transaction to be set at a variety of bit length. A session key is a key used by an encryption algorithm to create cipher text from plain text during a single secure session.
Secure HTTP (S-HTTP): Secure HTTP (S-HTTP) is an extension to HTTP that provides a number of security features, including client and server authentication, spontaneous encryption, and request/response nonrepudiation. S-HTTP provides symmetric encryption for maintaining secret communications and public key encryption to establish client/server authentication. S-HTTP differs from SSL in the way it establishes a secure session. SSL carries out a client/server handshake exchange to set up a secure communication, but S-HTTP sets up security details with special packet headers that are exchanged in S-HTTP. A secure envelope encapsulates a message and provides secrecy, integrity, and client/server authentication. S-HTTP is no longer used by many web sites. SSL has become a more generally accepted standard for establishing secure communication links between web clients and web servers.

Security for Server Computers
-The server is the third link in the client-internet server e-commerce path between the user and a web server.
Web Server Threats-Web server software is designed to deliver web pages by responding to HTTP requests. A web server can compromise secrecy if it allows automatic directory listings.
-Dictionary attack programs cycle through an electronic dictionary, trying every work in the book as a password. Users’ passwords, once broken, may provide an opening for illegal entry into a server that can remain undetected for a long time.
-buffer is an area of memory set aside to hold data read from a file or database. A buffer is necessary whenever any input or output operation takes place because a computer can process file info much faster than the info can be read from input devices or written to output devices.
-An access control list is a list or database of files and other resources and the usernames of people who can access the files and other resources.
-firewall is software or hardware and software combination that is installed in a network to control the packet traffic moving through it. Most organizations place a firewall at the internet entry point of their networks. The firewall provides a defense between a network and the internet or between a network and any other network that could pose a threat.
-networks inside the firewall are often called trusted, whereas networks outside the firewall are called untrusted. Acting as a filter, firewalls permit selected message to flow into and out of the protected network.
-Firewalls are classified into the following categories: packet filter, gateway server, and proxy server. Packet filter firewalls examine all data flowing back and forth between the trusted network and the internet. Packet filtering examines the source and destination addresses and ports of incoming packets and denies or permits entrance to the packets based on a preprogrammed set of rules. Gateway servers are firewalls that filer traffic based on the application requested. Gateway servers limit access to specific applications such as Telnet, FTP, and HTTP. In contrast to a packet filter technique, an application level firewall filters requests and logs them at the application level, rather than at the lower IP level. A gateway firewall provides a central point where all requests can be classified, logged, and later analyzed. Proxy server firewalls are firewalls that communicate with the internet on the private network’s behalf. Intrusion detection systems are designed to monitor attempts to login to servers and analyze those attempts for patterns and might indicate a cracker’s attack is underway. Once the intrusion detection system identifies an attack, it can block further attempts that originate form the same IP address. In addition to firewalls installed on organizations’ networks, it is possible to install software only firewalls on individual client computers-personal firewalls.