1. E-Commerce and Security Dr. John P. Abraham Professor University of Texas Pan American

2. Information Security as developed by the National Security Telecommunication and Information Systems Security Committee Protection of: Protection of: Information Information Hardware that store information Hardware that store information Hardware that transmit information Hardware that transmit information From direct and indirect attacks From direct and indirect attacks Without affecting availability to authorized users Without affecting availability to authorized users

3. Deliberate Security Threat Espionage (national security) Espionage (national security) Industrial Espionage Industrial Espionage Competitive intelligence (could be legal) Competitive intelligence (could be legal) Shoulder surfing Shoulder surfing Hacking Hacking Sabotage (ex.denial of service by zombies) Sabotage (ex.denial of service by zombies) Vandalism Vandalism Theft Theft

4. Some techniques Port scanning – enter through an open port Port scanning – enter through an open port Password crack (brute force or dictionary) Password crack (brute force or dictionary) Software scanning (what software is run) Software scanning (what software is run) Write scripts that can be used by software (malware) Write scripts that can be used by software (malware) Back doors (system passwords not changed) Back doors (system passwords not changed) Get access to a site and go from there to a trusted site Get access to a site and go from there to a trusted site Man in the middle Man in the middle

5. Protection Take all precautions Take all precautions Also have backup plans (contingency plan) Also have backup plans (contingency plan) Off site systems Off site systems Disaster recovery Disaster recovery

6. Firewall Technologies Packet filtering Packet filtering Application firewall (proxy server) Application firewall (proxy server) state inspection state inspection Dynamic packet filtering Dynamic packet filtering Kernel proxy Kernel proxy NAT NAT

7. Packet filtering and dynamic packet filtering

8. Cryptography Study of secret codes Study of secret codes Encrypting Encrypting Applying a substitution code Applying a substitution code Decrypting Decrypting Using the key to decode Using the key to decode Single key or multiple keys can be used Single key or multiple keys can be used