E-Commerce Security and Fraud Issues and Protections Chapter 10 E-Commerce Security and Fraud Issues and Protections

Learning Objectives Understand the importance and scope of security of information systems for EC. Describe the major concepts and terminology of EC security. Understand about the major EC security threats, vulnerabilities, and technical attacks. Understand Internet fraud, phishing, and spam. Describe the information assurance security principles. Identify and assess major technologies and methods for securing EC access and communications.

Learning Objectives Describe the major technologies for protection of EC networks. Describe various types of controls and special defense mechanisms. Describe consumer and seller protection from fraud. Discuss enterprisewide implementation issues for EC security. Understand why it is so difficult to stop computer crimes.

The Information Security Problem What Is EC Security? The Status of Computer Security in the United States Personal Security National Security Security Risks for 2014 and-2015

Major EC Security Management Concerns for 2011

The Information Security Problem Cyberwars and Cyberespionage Across Borders Cyberwarefare Attacking Information Systems Types of Attacks Corporate espionage Political espionage and warfare

The Information Security Problem The Drivers of EC Security Problems The Internet’s Vulnerable Design The Shift to Profit-Induced Crimes The Increased Volume of Wireless Activities and the Number of Mobile Devices The Globalization of the Attackers The *Darknet *Internet Underground Economy The Internet Silk Road *Keystroke logging (keylogging) The Explosion of Social Networking The Dynamic Nature of EC Systems and the Acts of Insiders The Sophistication of the Attacks The Cost of Cyber Crime

Basic E-Commerce Security Issues and Landscape Basic Security Terminology *Business continuity plan *Cybercrime *Cybercriminal *Exposure *Fraud *Malware (malicious software) *Phishing *Risk *Social engineering *Spam *Vulnerability *Zombie

Basic E-Commerce Security Issues and Landscape The EC Security Battleground The attacks, the attackers, and their strategies The assets that are being attacked (the targets) in vulnerable areas The security defense, the defenders, and their methods and strategy

The EC Security Battleground

Basic E-Commerce Security Issues and Landscape The Threats, Attacks, and Attackers Unintentional Threats Human Error Environmental Hazards Malfunctions in the Computer System Intentional Attacks and Crimes The Criminals and Methods *Hacker *Cracker

Basic E-Commerce Security Issues and Landscape The Targets of the Attacks in Vulnerable Areas Vulnerable Areas Are Being Attacked Vulnerability Information Attacking E-Mail Attacking Smartphones and Wireless Systems The Vulnerability of RFID Chips The Vulnerabilities in Business IT and EC Systems Pirated Videos, Music, and Other Copyrighted Material

Basic E-Commerce Security Issues and Landscape EC Security Requirements *Authentication *Authorization Auditing Availability *Nonrepudiation

Basic E-Commerce Security Issues and Landscape The Defense: Defenders, Strategy, and Methods EC Defense Programs and Strategy *EC security strategy *Deterrent methods *Prevention measures *Detection measures *Information assurance (IA) Possible Punishment Defense Methods and Technologies Recovery

Technical Malware Attack Methods: From Viruses to Denial of Service Technical and Nontechnical Attacks: An Overview The Major Technical Attack Methods Malware (Malicious Code): Viruses, Worms, and Trojan Horses * Viruses * Worms

The Major Technical Security Attack Methods

Technical Malware Attack Methods: From Viruses to Denial of Service * Macro virus (macro worm) * Trojan horse Some Recent Security Bugs: Heartbleed and Crytolocker * Denial-of-service (DoS) attack Web Server and Web Page Hijacking * Page hijacking * Botnets Malvertising

How a Computer Virus Can Spread

Nontechnical Methods: From Phishing to Spam and Fraud Social Engineering and Fraud Social Phishing *Phishing *Pharming Fraud and Scams on The Internet Examples of Typical Online Fraud Attacks E-Mail Scams Top 10 Attacks and Remedies *Identity Theft and Identify Fraud Cyber Bank Robberies

Social Engineering: From Phishing to Financial Fraud and Crime

How Phishing Is Accomplished

Nontechnical Methods: From Phishing to Spam and Fraud Spam Attacks *E-mail spam Typical Examples of Spamming *Spyware Social Networking Makes Social Engineering Easy How Hackers Are Attacking Social Networks Spam in Social Networks and in the Web 2.0 Environment *Search engine spam *Splog *Data Breach (Leak)

The Information Assurance Model And Defense Strategy Confidentiality, Integrity, and Availability *Confidentiality *Integrity *Availability Authentication, Authorization, and Nonrepudiation

The Information Assurance Model And Defense Strategy E-Commerce Security Strategy The Phases of Security Defense Prevention and deterrence (preparation) Initial response Detection Containment (contain the damage) Eradication Recovery Correction Awareness and compliance Security Spending Versus Needs Gap

E-Commerce Security Strategy Framework

The Information Assurance Model And Defense Strategy The Defense Side of EC Systems Defending access to computing systems, data flow, and EC transactions Defending EC networks General, administrative, and application controls Protection against social engineering and fraud Disaster preparation, business continuity, and risk management Implementing enterprisewide security programs Conduct a vulnerability assessment and a penetration test Assessing Vulnerabilities and Security Needs *Vulnerability assessment *Penetration test (pen test)

The Defense I: Access Control, Encryption, and PKI Authorization and Authentication Biometric Systems *Biometric authentication *Biometric systems Encryption and the One-Key (Symmetric) System *Encryption *Plaintext *Ciphertext *Encryption algorithm *Key (key value) *Key space *Symmetric (Private) Key Encryption

Symmetric (Private) Key Encryption

The Defense I: Access Control, Encryption, and PKI *Public key infrastructure (PKI) *Public (asymmetric) key encryption *Public key *Private key The PKI Process: Digital Signatures and Certificate Authorities *Digital signatures *Hash function *Message digest *Digital envelope *Certificate authorities (CAs) Secure Socket Layer (SSL) Other Topics and Methods of Defense

Digital Signature

The Defense II: Securing E-Commerce Networks *Firewalls *Packets The Dual Firewall Architecture: The DMZ *Personal Firewalls *Virtual private network (VPN) *Protocol tunneling *Intrusion Detection Systems (IDS) Cloud Computing Prevents DoS Attacks Honeynets and Honeypots *Honeynet *Honeypots E-Mail Security

The Two Firewalls: DMZ Architecture

The Defense III: General Controls, Spam, Pop Ups, Fraud, And Social Engineering Controls *Application controls General, Administrative, and Other Controls Physical Controls Administrative Controls Protecting Against Spam *CAN-SPAM Act

Major Defense Controls

The Defense III: General Controls, Spam, Pop Ups, Fraud, And Social Engineering Controls Protecting Your Computer from Pop-Up Ads Tools for Stopping or at Least Minimizing Pop-Ups Protecting against Other Social Engineering Attacks Protecting against Phishing Protecting against Malvertising Protecting Against Spyware Protecting Against Cyberwars

The Defense III: General Controls, Spam, Pop Ups, Fraud, And Social Engineering Controls Fraud Protection Business Continuity, Disaster Recovery, and Risk Management Risk-Management and Cost-Benefit Analysis

Business Continuity Services and IT Recovery Process

Implementing Enterprisewide E-Commerce Security The Drivers of EC Security Management Senior Management Commitment and Support EC Security Policies and Training Cyber Threat Intelligence (CTI) EC Risk Analysis and Ethical Issues *Business impact analysis (BIA) Ethical Issues

Enterprisewide EC Security and Privacy Model

Implementing Enterprisewide E-Commerce Security Why Is It Difficult to Stop Internet Crime? Making Shopping Inconvenient Lack of Cooperation by Business Partners Shoppers’ Negligence Ignoring EC Security Best Practices Design and Architecture Issues Lack of Due Care in Business Practices *Standard of due care Protecting Mobile Devices, Networks, and Applications Mobile Security Issues The Defense

Managerial Issues What steps should businesses follow in establishing a security plan? Should organizations be concerned with internal security threats? What is the key to establishing strong e-commerce security?

Summary The importance and scope of EC information security. Basic EC security issues. Threats, vulnerabilities, and technical attacks. Internet fraud, phishing, and spam. Information assurance. Securing EC access control and communications.

Summary Technologies for protecting networks. The different controls and special defense mechanisms. Protecting against fraud. Enterprisewide EC security. Why is it so difficult to stop computer crimes?