...Project part 4 IS3445 Common weaknesses and attacks associated with e-commerce and social networking applications Security of transactions is critical in building the confidence of customers in a specified e-commerce site. This security depends heavily on an organization's ability to ensure authenticity, availability, privacy, integrity and disruption of unwanted intrusions. Malicious program known as sniffer programs often disrupt the privacy transactions especially when one uses unauthorized networks. They are found at network connection end points. When transactions are carried out, confidentiality is necessary thus it requires removing of any data showing transaction paths. This has become a common problem in the e-commerce sites. Another common problem for e-commerce site is a Trojan horse. A Trojan horse, or Trojan, in computing is a generally non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. Hackers and cyber-criminals are motivated by financial gain, notoriety, or simply by the thrill of the challenge. Cyber-crime can be extremely lucrative. The sale of cyber-resources including credit card information, stolen intellectual property, or networks of compromised, Internet-connected servers has created a burgeoning black market economy. The tools created for these purposes are openly shared on the Internet...
Words: 367 - Pages: 2
...IS3445 – Week 10 Assignment Project Part 10. Web Security Life Cycle Software development life cycles are created to help guide businesses towards meeting specific desires and needs within their applications. They drive the steps used to meet best practices and standards that businesses are required to follow to function. SDLCs are made up of various different stages such as; assessments, application development, QA testing, deployments, etc. Best practices and standards dictate that implementing security within the various steps of an SDLC if not all of the steps will provide the best results that any business is trying to achieve. An SDLC can come in a few different models like a waterfall model, spiral model and a V-Model. This document will be used to describe and give a brief summary on many different processes. Application Development: During the development of web applications, things such as poor error handling, and unsecure data transferring can plague the development. Poor error handling could result in malicious users finding much more information about a application than should be revealed and can use that information to gain access to unauthorized areas, while unsecure data transferring could result in data being stolen as it is broadcasted across a network. QA/Testing: Security professionals that continually test software and web applications for malicious attacks or security flaws ensure that products will continue to work as desired. Examples of testing...
Words: 1029 - Pages: 5
...UNFO, a brick-and-mortar retailer now has move into the e-commerce, e-business model has developed new risk that will affect the business. As UNFO information security analyst it is my job to prepare an executive summary report designed to assist the team in understanding IT security risks associated with e-commerce and e-business models. Malicious program known as sniffer programs often disrupt the privacy transactions especially when one uses unauthorized networks. They are found at network connection end points. When transactions are carried out, confidentiality is necessary thus it requires removing of any data showing transaction paths. This has become a common problem in the e-commerce sites. Another particularly common problem facing e-commerce and social network applications is the Trojan horse. Back Orifice, Netbus and BO2K are the most common types. They are hacker tools that enable a remote hacker to control, examine and monitor the user’s information. These Trojans are dangerous since they can provide the hacker a platform for sending information and make it appear as if the real owner of the computer has done so. The payoff of a successful attack is one of the motivations for hackers. If you were to take a penny from every account at any one of the major banks, it easily amounts to several million dollars. The local bank robber optimistically expects a windfall in the tens of thousands of dollars. Bank branches do not keep a lot of cash on hand. The majority is...
Words: 499 - Pages: 2
...IS3445 Security Strategies for Web Applications and Social Networking Lab 7 Assessment 05/10/14 1. How does Skipfish categorize findings in the scan report? As high risk flaws, medium risk flaws, and low issue scans 2. Which tool used in the lab is considered a static analysis tool? Explain what is referred to by static code analysis. RATS, because the running of static code analysis tools that attempt to highlight possible vulnerabilities within ‘static’ (non-running) source code. 3. What possible high risk vulnerabilities did the Rats tool find in the DVWA application source code? Allow system commands to execute. 4. Did the static analysis tool find all the potential security flaws in the application? Yes, although such tools like these would automatically find security flaws with high degree of confidence that what it found was a flaw. 5. What is black box testing on a web site or web application? They’re designed to threat the application as an “unknown entity”; therefore, no knowledge of the tiers is provided. 6. Explain the Skipfish command in detail: ./skipfish-o/var/scans/is308lab.org –A admin:password –d3 –b I –X logout.jsp –r200000 http://www.is308lab.org This is a standard, authenticated scan of a well-designed and self-contained site. 7. During the manual code review, what is noticed about high.php to make it less likely to vicitimize users with XSS reflection and why is it considered more secure? Because when a php is at high-level...
Words: 379 - Pages: 2
...Project Part 5: Analyze the Software Development Life Cycle (SDLC) IS3445 Mr. Hollis The right choice for a SDLC (Software Development Lifecycle) approach for your IT needs are as pertinent to the proper management of the project as the integration of any technical path of best practices. Choosing the improper software technique and you could add unnecessary time to the deployment and development vitality of the implemented software. By additional time to the software life course will exponentially add to your costs and most likely halt you from achieving the development within a timely manner. I recognize not all project management is allowed to choose the software lifecycle that will be implemented on all developments. Businesses possibly invested primarily in the software and advancements utilized to deploy their software. In this paper, a contradictory view of SDLC process is describe, it is based on development, distinguishing classifications and then characteristics are revealed. In the very early stages of computing, software development was produced by many individuals, each having their own protocols to follow. Majority of the time, the deployment process was a form of “programing language then repair”, Such the technical writer conducts a form of commands and then probes it to get results. Software expanded exponentially more difficult and meticulously rested on computers for most of their computing, including expenses and labor, this attributed to a more formal...
Words: 326 - Pages: 2
...ITT Technical Institute IS3340 Windows Security Onsite Course SYLLABUS Credit hours: 4.5 Contact/Instructional hours: 60 (30 Theory Hours, 30 Lab Hours) Prerequisite(s) and/or Corequisite(s): Prerequisite: NT2580 Introduction to Information Security or equivalent Course Description: This course examines security implementations for a variety of Windows platforms and applications. Areas of study include analysis of the security architecture of Windows systems. Students will identify and examine security risks and apply tools and methods to address security issues in the Windows environment. Windows Security Syllabus Where Does This Course Belong? This course is required for the Bachelor of Science in Information Systems Security program. This program covers the following core areas: Foundational Courses Technical Courses BSISS Project The following diagram demonstrates how this course fits in the program: IS4799 NT2799 IS4670 ISC Capstone Project Capstone ProjectCybercrime Forensics NSA NT2580 NT2670 Introduction to Information Security IS4680 IS4560 NT2580 NT2670 Email and Web Services Hacking and Introduction to Security Auditing for Compliance Countermeasures Information Security Email and Web Services NT1230 NT1330 Client-Server Client-Server Networking I Networking II IS3230 IS3350 NT1230 NT1330 Issues Client-Server Client-Server SecurityContext in Legal Access Security Networking I Networking II NT1110...
Words: 2305 - Pages: 10