Contents

INTRODUCTION 4

SECURITY 4
Client Security 4
Server Security 5
Document Confidentiality 5

Risks and threats to E-commerce Sites 5
Hackers 5
Software/hardware failure 5

WHY SECURITY FAIL 6
Exposure of confidential data 6
Modification of Data 6
Errors in Software 6
Poor stipulation and testing 6
Repudiation 6

Solutions to E-commerce Security Risks 7
Encryption 7
Data Encryption Standard (DES) 7
RSA Public Key Algorithm 8
Digital signatures 8
Digital certificates 9
Security for Transactions 9
Secure sockets layer 10
Secure Electronic Transactions (SET) 10

Conclusions 11

INTRODUCTION

Internet security is not fully understood by many. However, it is an integral part of
Using the Internet safely, most of the security on the Internet is not seen nor its
Existence known to the user. The importance of web security is to keep the user, the E-
Commerce Merchants and Authorised third parties safe whilst carrying out normal
Browsing and transactions online.

SECURITY

To examine web security we need to look at all the main components of a connection, which are the browser and the Server and then examine the connection between the two. The user, via their web Browser, connects to a remote web server and requests a document. The server then Returns the document, and the browser displays it. This seems a simple enough process,
So what could go wrong?

From the users point of view, the remote server is owned and operated by the
Organisation that it seems to be owned by so the user expects that the documents that
The server returns are free from viruses and malicious intent and the user will also
Expect the remote server not record or distribute information that the user considers
Private, such as their web browsing habits.

From the webmasters view they expect the user not attempt to break into the web
Server computers system or alter the contents of the website also that the user will not
Try to gain access to documents that they are not allowed.

From both their views they expect that the transaction of service between browser and
Server is delivered intact, free from tampering from third parties. The main purpose of
Web security is to ensure that these assumptions remain valid, as the web
Connection has three parts; web security also has three parts

1. Client security
2. Server security
3. Document Confidentiality

Client Security
These are security measures that protect the user’s privacy and the integrity of their
Computer and data. Safeguards are introduced to protect users against computer
Viruses and other malicious software as well as monitor the amount of personal
Information that browsers can transmit without the users consent. Also in this category
Are steps that organisations can take to prevent employee’s web browsing activities
From compromising the security of the company’s confidential information or the
Integrity of its local area network.

Server Security
These are measures that protect the web server and the machine it runs on from break
Downs and tumours. To aid this are software’s like firewall systems to operating system
Security measures.

Document Confidentiality

These are measures that protect private information from being disclosed to third
Parties, i.e. spoofing.

Risks and threats to E-commerce Sites

1) Hackers
2) software/hardware failure
Hackers

The most eminent threat to E-commerce comes from malicious computer users
Known as hackers and all businesses run the risk of becoming targets of criminals.

Securing a site involves a combination of:
 Storage and handling o Keeping backups of important information o Having hiring policies that attract honest staff and keep them loyal. o Taking software-based precautions, such as choosing secure software and
 keeping up-to-date o Training staff to identify targets and weaknesses o Auditing and logging to detect break-ins or attempted break-ins
Software/hardware failure

It is always safer to have multiple backup data/files in different locations in case of a
Software/hardware failure so that if a failure should occur it does not affect the
Operation of the whole system.

Now that the more general risks that E-commerce websites face have been examined,
The security issues that present themselves to E-commerce websites can be
Crucially examined.

WHY SECURITY FAIL

Exposure of confidential data

A web server is the wrong place for the storage of confidential information as it is
Information that is made accessible by the public unless intended. To reduce the risk of
Exposure it is important to limit the methods by which information can be accessed
And Limit the people who can access it as it can also lead to loss of files. Authentication is a main requirement for websites. It means asking people to prove their identity. The most common ways of authentication are passwords and digital signatures.

Modification of Data

Modification to files could include changes to data files or executable files. A hacker’s motivation for Altering a data file Might be to vandalise a company’s site or to obtain fraudulent Benefits. Replacing The Data can be protected from modification as it travels over the network by using digital Signatures. This does not stop somebody from modifying the data but if the signature Still matches when the files arrive, it can be seen whether the file has been modified.

Errors in Software

Errors in software can lead to all sorts of unpredictable behaviour including service unavailability, security Breaches, financial losses and poor service to customers. Common causes of errors that can be looked for are poor specifications, faulty assumptions made by developers and inadequate testing.

Poor stipulation and testing

It is not possible to test for all possible input conditions, on all possible types of
Hardware, running all possible operating systems with all possible user settings. This
Is even more true than usual with web-based systems. What is needed is a well-
Designed test plans that tests all the functions of the software on a representative

Repudiation

Repudiation occurs when a party involved in a transaction denies haven taken part.
A customer might include a person ordering goods off a website and then
Denying having authorised the change on his credit card. Ideally financial transactions should provide the peace of mind of non-repudiation to both Parties. Authentication provides some surety about whom you are dealing with. If issued by a trusted organisation, digital certificates of authentication can provide Comfortable confidence.

Solutions to E-commerce Security Risks

Encryption

This is the translation of data into a secret code making data unreadable to potential
Hackers. It’s the most effective way to achieve data security. Encryption also known as
Cryptography can also be used to check the authenticity of a message or the integrity of
A file.

There are two basic ways of encrypting:
• Symmetrical
• Asymmetrical

Symmetrical Algorithms use a single key that both the person sending and the person
Receiving the coded message must know. Asymmetrical methods, on the other hand,
Use two keys, one of which is deliberately published. If a message is to be sent to more than
One person, a key has to be produced for each and it must be sent to each of them.
Therefore, key management and distribution are the main problems with symmetrical
Encryption algorithms.

Example in fig I

Data Encryption Standard (DES)

The best-known standard for symmetrical encryption is the Data Encryption Standard
(DES), which IBM developed for the National Bureau of Standards in the 1970s.
DES encryption uses a 64-bit key (including eight parity bits - so the actual key itself
Is 56-bits long) converting 64-bit blocks of plain text into 64-bits blocks of code.
Authorized users of encrypted computer data must have the key that was used to
Encipher the data in order to decrypt it.

RSA Public Key Algorithm

This algorithm is perhaps the best known and the most popular embodiment of the
Diffie-Hellmann public key algorithm principles is the RSA algorithm, which is
Named after its inventors; Ronald Rivest, Adi Shamir and Leonard Alderman (1978).
The high level of security the RSA algorithm offers derives from the difficulty of
Decomposing large integers into prime factors: that is, two primes which, when
Multiplied by one another, give the original number. One of the drawbacks with RSA
Algorithm compared, with symmetrical methods is that encrypting and decrypting
Messages takes much more computing power. The fastest RSA chip now in existence
Can only manage a throughput put of 600KBit/s when using 512-bit primes.
Comparable DES hardware implementations are anything from1000 to 10 000 times
Faster. At present, DES software implementations can encrypt around 100
Times faster than the RSA algorithm.

Digital signatures

A digital signature is like a normal signature, in that it identifies you uniquely and is Difficult to fake. It really enables the merchant to verify that the communication actually came from the user. The full description of the digital signature process is described below.
 Encrypt message. As normal, first the sender encrypts the message with the recipient's public key
 Add signature. Then the sender adds their signature to the encrypted message, perhaps some text like "This message is from angel ideh", and then encrypts the whole thing with their own private key.
 Decrypt signature. The recipient receives the message and decrypts it with the sender's public key, which produces the digital signature and the encrypted message.
 Decrypt message. The recipient then decrypts the remaining message with their own private key.

Digital certificates

Digital certificates play an integral role in keeping E-commerce safe.
A digital certificate contains an entity's name, address, serial number, public key,
Expiration date and digital signature, among other information. When a Web
Browser like Firefox, Netscape or Internet Explorer makes a secure connection,
The digital certificate is automatically turned over for review. The browser checks it for
Anomalies or problems, and pops up an alert if any are found.
When digital certificates are in order, the browser completes secure connections
Without interruption.

Security for Transactions

Cryptographic principles are incorporated into communications protocols and
Software. On the web, SSL (Secure Sockets Layer) is the dominant protocol for
Encrypting general communications between browser and server, while SET (Secure
Electronic Transactions) is a specialised protocol for safeguarding credit-card based
Transactions.

Secure sockets layer

The SSL protocol was originally developed by Netscape, to ensure security of data
Transported and routed through HTTP, LDAP or POP3 application layers. SSL is
Designed to make use of TCP as a communication layer to provide a reliable end-to-end
Secure and authenticated connection between two points over a network e.g.
Between the service client and the server.

Secure Electronic Transactions (SET)
SET is an open standard available to anyone engaged in electronic commerce. It’s a Protocol designed to ensure the security and integrity of online communications and Purchases, Secure Electronic transaction (SET) uses digital certificates, issued to Merchants and other businesses and customers, to perform a series of security checks Verifying that the identity of a customer or sender of information is valid. Digital certificates, digital signatures, and digital wallets all function according to the SET protocol.

Conclusions

Internet shopping is growing around the world and as it does the number of
E-businesses are also increasing. This results in a rise in the amount of exposure that
Customer’s confidential data may face through poor security measures implemented by
The e-Commerce merchant. There are always going to be customer concerns about
Security and the best thing that merchants can do is try to reassure customers by
Implementing appropriate security measures and displaying trust marks on the
Website. Through the course of this coursework the main aspects of security that were
Found to be implemented are:
• Encryption
• Digital signature
• Digital certificates
• SSL channels set-up for secure transactions

"E-commerce is an evolution" - By using electronic technology through the internet, it achieved * More competitions, more marketplaces, faster transactions, and more advanced technologies to make activities between customers and producers more active. * We as customers and internet users are responsible to keep our e-commerce healthy and safe so that e-business can be more reliable in the future.

References

E-business http://www.zdnet.com an e-journal that provides e-commerce headlines as well as links to other resources including reports and white papers.

E-Business Research Centre http://www.cio.com/research/ec/ CIO Magazine's e-commerce site includes discussion forums, articles, and other useful resources.
The e-commerce Guidebook http://www.online-commerce.com/ provides a step-by-step guide to the process of becoming e-commerce enabled, a directory of online transaction providers, and a compilation of Web resources.
E-Commerce 2010 (6th Edition)
Kenneth laudon.