1. Introduction University of Sunderland CIT304 Harry R Erwin, PhD

2. Purpose The purpose of CIT304 (E-Commerce) is to prepare an advanced beginner for an entry- level e-commerce position. CIT304 addresses: –E-Commerce (taught by John Wraith, MBA) –Security (taught by Harry Erwin, PhD) –Server-side programming (taught by Harry Erwin, PhD)

3. Responsibility Dr. Harry Erwin is the Module Leader for CIT304 at the University of Sunderland. Dr. Erwin has 35 years of experience as a software systems engineer and security engineer (mostly at TRW) for high-reliability systems. He supervises final year/MSc projects and PhD research in intelligent systems, security, and software engineering. E-mail: harry.erwin@sunderland.ac.uk or herwin@theworld.comharry.erwin@sunderland.ac.uk herwin@theworld.com

4. Responsibility (II) John Wraith, MBA, is the assistant Module Leader for CIT304 and will teach the e- commerce material. Mr. Wraith is probably already known to you as a domain expert in e-commerce. E-mail: john.wraith@sunderland.ac.ukjohn.wraith@sunderland.ac.uk

5. Objectives To develop a critical awareness of the current state of electronic commerce and the ability to develop viable electronic commerce solutions. Students will need to understand the impact of electronic commerce technologies on business practices as well as the issues of electronic commerce technologies such as security, third party licensing rights and other legal implications.

6. Learning Outcomes Upon successful completion of this module, students will have demonstrated knowledge of –The use of scripting languages in the server side database application. This is assessed by examination. –The role of security in protecting such applications. This is assessed by examination and the first two project assignments. –The business and technological issues of web-based eCommerce application such as trusted 3rd parties and validation of electronic documents. This is assessed by examination and the third project assignment. and the ability to –To develop and critically evaluate technological and management strategies for the migration of business activities to a web-based solution. This is assessed by the third project assignment.

7. Indicative Content On core technologies aspects, students will be looking into active web-page design (eg. server side database, scripting languages, etc) On technological issues, students will be investigating internet security issues (eg, secure sockets, PGP), authentication and non-repudiation. Business issues explored will include the validation of sources of electronic documents, law of evidences, electronic contracting and roles of trusted 3rd parties and data protection acts.

8. On Practicing Ref: Philip E. Ross (2006) “Secrets of the Expert Mind”, Scientific American, 295(2):46-53, August 2006. There is also a recent article in New Scientist reporting the same results Expertise turns out to be knowledge-guided perception (apperception)—structured knowledge, not analysis—and is usually the result of intensive training, not talent. What matters is not experience per se, but “effortful study”, involving continually tackling challenges just beyond one's competence. Plan on effortful study and interacting with your tutors if you want to make the most of my modules.

9. On Mentoring Most people can’t judge their level of competence, so that’s where good teachers and mentors come in. Find someone who will give you an objective view of how well you are doing. Don’t worry about how well you’re doing in comparison to others—just be concerned that you are making progress.

10. Goal Exercise

11. Scope of the Module Security. This will be an introduction to formal security requirements analysis and design. E-Commerce Active Web-Page Design. This will explore JSP (Java Server Pages).

12. Outline 24 Lectures 12 Tutorials A comprehensive coursework assignment, consisting of two parts: security and e- commerce. A 3-hour exam on security, script programming, and e-commerce We will use vista.sunderland.ac.uk for communication, discussions, and submitting coursework.

13. Textbooks Key texts for CIT304 that students must acquire: –Anderson, 2001, Security Engineering, Wiley, ISBN: 0-471- 38922-6. This is available free on the web. –D. Chaffey, 2002, E-Business and E-Commerce Management, Pearson Education Limited, Second Edition. Some CIT304 support texts students might read:  B. Schneier, 2000, Secrets and Lies, Wiley.  P. Neumann, 1995, Computer-Related Risks, Addison-Wesley.  Rescorla, E., 2001, SSL and TLS, Pearson Education.  Garfinkel and Spafford, Practical Unix and Internet Security, 3rd edition, O’Reilly.  Amoroso, 1999, Intrusion Detection, Intrusion.net.  Barrett and Silverman, 2001, SSH, the Secure Shell, O’Reilly.

14. Presentation Topics (Erwin) Introduction (1 lecture) Risk and Trust Analysis (2 lectures) Security Analysis (3 lectures) Security Mechanisms (3 lectures) Security Management (3 lectures) Script Programming (2 lectures)

15. Course Marking Two elements: coursework and examination, each counting half. Overall coursework and exam marks must be at least 35% and the module mark must be at least 40% for you to pass. Written assignments may be submitted in essay or report format. Referencing your sources is required.

16. Questions?