E-commerce. Security. Learning objectives. Internet Security Issues: Overview. Managing Risk-1. Managing Risk-2. Computer Security Classifications

(1)

Nov 19, 2004 www.dcs.bbk.ac.uk/~gmagoulas/teaching.html 1

E-commerce

Security

Threats and Protection Mechanisms. This lecture covers internet security issues and discusses their impact on an e-commerce.

Learning objectives

You will learn about:

l

Internet security issues

l

Security for client computers

l

Security for the communication channels between computers

l

Security for server computers

l

Organizations that promote computer, network, and Internet security

Internet Security Issues:

Overview

l

Computer security: The protection of assets from unauthorized access, use, alteration, or destruction

l

Physical security: Includes tangible protection devices

l

Logical security: Protection of assets using nonphysical means

l

Threat: Any act or object that poses a danger to computer assets

Managing Risk

-1

l

Countermeasure: General name for a procedure that recognises, reduces, or eliminates a threat

l

Eavesdropper: Person or device that can listen in on and copy Internet transmissions

l

Crackers or hackers: Write programs or manipulate technologies to obtain unauthorized access to computers and networks

Managing Risk

-2

Computer Security Classifications

l

Secrecy: Protecting against unauthorized data disclosure and ensuring the

authenticity of data source

l

Integrity: Refers to preventing

unauthorized data modification

Necessity: Refers to preventing data

(2)

Security Policy and Integrated Security -1

l

A written statement describing

lWhich assets to protect and why they are being protected

lWho is responsible for that protection

lWhich behaviors are acceptable and which are not l

First step in creating a security policy

lDetermine which assets to protect from which threats

lDefine minimum level of acceptable security

Security Policy and Integrated Security

^-2:

Requirements for Secure Electronic Commerce

Security Policy and Integrated Security

^-3

Elements that a security policy should address:

lAuthentication: who is trying to access?

lAccess control: who is allows to log on and access?

lSecrecy: who is permitted to view selected info?

lData integrity: who is allowed to change data?

lAudit: who or what causes specific events to occur and when?

Security Policy and Integrated Security

-4:Security for Client Computers l

Active content: Programs embedded

transparently in Web pages and cause action to occur

l

Scripting languages: Provide scripts, or commands, that are executed (JavaScript;

VBScript)

l

Applet: Small application program (Java Applets)

Security Policy and Integrated Security

-5:Security for Client Computers

l

Trojan horse: Program hidden inside another program or Web page that masks its true purpose

l

Zombie:

lProgram that secretly takes over another computer to launch attacks on other computers

lAttacks can be very difficult to trace to their creators

Example: Dialog box asking for Permission to Open a Java Applet

(3)

Security for Client Computers-

Cookies1

l Cookie Central: Web site devoted to Internet cookies

l Session cookies: Exist until the Web client ends connection

l Persistent cookies:

Remain on client computer indefinitely

Example: Information Stored in a Cookie on a Client Computer

Security for Client Computers-

Cookies2

l

First-party cookies: Cookies placed on client computer by Web server site

l

Third-party cookies:

Cookies placed on client computer by different Web site

l

Web bug: Tiny graphic that a third-party Web site places on another site’s Web page

Security for Client Computers-

Java Applets

l

Java: High-level programming language developed by Sun Microsystems

l

Java sandbox: Confines Java applet actions to a set of rules defined by the security model

l

Untrusted Java applets : Applets not established as secure

Security for Client Computers-

JavaScript

l

Scripting language developed by Netscape to enable Web page designers to build active content

l

Can be used for attacks by

lExecuting code that destroys client’s hard disk

Security for Client Computers-

ActiveX Controls

l

Object containing programs and properties that Web designers place on Web pages

l

Common programming languages used

lC++ and Visual Basic

(4)

Example:

Internet Explorer ActiveX Control Warning Message

Security for Client Computers-

Viruses, Worms, and Antivirus Software l

Virus: Software that attaches itself to

another program and Can cause damage when host program is activated

l

Warm: virus that replicates itself on the computer that it infects

l

Macro virus: Type of virus coded as a small program (macro) and is embedded in a file

l

Antivirus software: Detects viruses and worms

Security for Client Computers-

Steganography

l

Describes process of hiding information within another piece of information

l

Provides way of hiding an encrypted file within another file

l

Messages hidden using steganography are difficult to detect

Protecting Client Computers-

Digital Certificates1

l

A program embedded in a Web page that

lVerifies that the sender or Web site is who or what it claims to be

l

Signed code or messages

lProvide proof that the holder is the person identified by the certificate

l

Certification authority (CA)

lIssues digital certificates

Example: Amazon.com’s Digital

Certificate Protecting Client Computers-

Digital Certificates2

l

Main elements included:

lCertificate owner’s identifying information

lCertificate owner’s public key

lDates between which the certificate is valid

lSerial number of the certificate

lName of the certificate issuer

lDigital signature of the certificate issuer

(5)

Communication Channel Security

l

Secrecy

lPrevention of unauthorized information disclosure

lPrivacy is the protection of individual rights to nondisclosure

l

Sniffer programs

lProvide means to record information passing through a computer or router that is handling Internet traffic

Communication Channel Security- Integrity Threats

l

Exists when an unauthorized party can alter a message stream of information

l

Cybervandalism

lElectronic defacing of an existing Web site’s page l

Masquerading or spoofing

lPretending to be someone you are not l

Domain name servers (DNSs)

lComputers on the Internet that maintain directories that link domain names to IP addresses

Communication Channel Security- Necessity Threats

l

Purpose is to disrupt or deny normal computer processing

l

Denial of Service attacks

lRemove information altogether or

lDelete information from a transmission or file

Communication Channel Security- Threats to Wireless Networks

l

Wardrivers

lAttackers drive around using their wireless- equipped laptop computers to search for accessible networks

l

Warchalking

lWhen wardrivers find an open network they sometimes place a chalk mark on the building

Protecting Communication Channel- Encryption Solutions

l

Encryption

lUsing a mathematically based program and a secret key to produce a string of characters that is unintelligible

l

Cryptography

Protecting Communication Channel- Encryption Algorithms

l

Encryption

lThe coding of information by using a

mathematically based program and secret key l

Encryption program

lProgram that transforms normal text into cipher text

(6)

Protecting Communication Channel- Hash Coding

l

Process that uses a hash algorithm to calculate a number from a message of any length

l

Good hash algorithms

lDesigned so that probability of two different messages resulting in same hash value is small l

Convenient way to tell whether a message has

been altered in transit

Protecting Communication Channel- Asymmetric Encryption1

l

Encodes messages by using two mathematically related numeric keys

l

Public key

lFreely distributed to the public at large

l

Private key

lBelongs to the key owner, who keeps the key secret

Protecting Communication Channel- Asymmetric Encryption2

l

Pretty Good Privacy (PGP)

lOne of the most popular technologies used to implement public-key encryption

lSet of software tools that

lCan use several different encryption algorithms to perform public-key encryption

lCan be used to encrypt their e-mail messages

Protecting Communication Channel- Symmetric Encryption

l

Encodes message with one of several available algorithms that use a single numeric key

l

Data Encryption Standard (DES): Set of encryption algorithms adopted by the U.S.

government for encrypting sensitive information

l

Triple Data Encryption Standard

lOffers good protection

lCannot be cracked even with today’s supercomputers

Comparing Asymmetric and Symmetric Encryption Systems

l

Public-key (asymmetric): Systems provide several advantages over private-key (symmetric) encryption methods

l

Secure Sockets Layer (SSL): protocol that provides secure information transfer through the Internet. SSL secures connections between two Computers

l

S-HTTP: Sends individual messages securely.

Extension of “htttp”

(a) Hash coding, (b) Private-key, and (c) Public-key Encryption

(7)

Ensuring Transaction

Integrity with Hash Functions

l

Integrity violation

lOccurs whenever a message is altered while in transit between the sender and receiver l

Hash algorithms are one-way functions

lThere is no way to transform the hash value back to original message

l

Message digest

lSmall integer number that summarizes the encrypted information

Ensuring Transaction Integrity with Digital Signatures

l

Hash algorithm

lAnyone could

lIntercept a purchase order

lAlter the shipping address and quantity ordered

lRe-create the message digest

lSend the message and new message digest on to the merchant

l

Digital signature

lAn encrypted message digest

Sending and Receiving a Digitally Signed Message

Security for Server Computers

l

Web server

lCan compromise secrecy if it allows automatic directory listings

lCan compromise security by requiring users to enter a username and password

l

Dictionary attack programs

lCycle through an electronic dictionary, trying every word in the book as a password

Other Programming Threats

l

Buffer

lAn area of memory set aside to hold data read from a file or database

l

Buffer overrun

lOccurs because the program contains an error or bug that causes the overflow

l

Mail bomb

Protecting the web server-

Firewalls1

l

Computer and software combination installed at the Internet entry point of a networked system

l

Provides a defense between

lNetwork to be protected and the Internet, or other network that could pose a threat

(8)

Protecting the web server-

Firewalls2

l

Characteristics

lAll traffic from inside to outside and from outside to inside the network must pass through firewall

lOnly authorized traffic is allowed to pass

lFirewall itself is immune to penetration l

Trusted

lNetworks inside the firewall l

Untrusted

lNetworks outside the firewall

Protecting the web server-

Firewalls3

l

Packet-filter firewalls: Examine data flowing back and forth between trusted network and the Internet

l

Gateway servers: Firewalls that filter traffic based on the application requested

l

Proxy server firewalls: Firewalls that communicate with the Internet on the private network’s behalf

Organizations that Promote Computer Security

l

Computer Emergency Response Team

lResponds to thousands of security incidents each year

lHelps Internet users and companies become more knowledgeable about security risks

l

Posts alerts to inform Internet community about security events

Other Organizations

l

SANS Institute

lA cooperative research and educational organization

l

Internet Storm Center

lWeb site that provides current information on the location and intensity of computer attacks l

Microsoft Security Research Group

lPrivately sponsored site that offers free information about computer security issues

Computer Forensics and Ethical Hacking

l

Computer forensics experts

lHired to probe PCs and locate information that can be used in legal proceedings

l

Computer forensics

lThe collection, preservation, and analysis of computer-related evidence

Summary

l

Assets that companies must protect: Client computers; Computer communication

channels; Web servers (susceptible to security threats)

l

Communication channels, in general, and the Internet, in particular are especially vulnerable to attacks

l

Encryption: Provides secrecy

(9)

Next week

User Experience in E-commerce

l

Personalisation

l