1 Chapter 12 Electronic Commerce Systems

2 Objectives for Chapter 12 zBasic network topologies used to achieve connectivity within an Intranet zFunctions of network software, including managing communications sessions and avoiding data collision zCharacteristics of EDI technology and its application in a trading partner relationship zBasic technologies and layered approach to protocols used in Internet communications zThe business opportunities and risks associated with electronic commerce zThe key security and assurance issues pertaining to electronic commerce

3 What is E-Commerce? The electronic processing and transmission of business data zelectronic buying and selling of goods and services zonline delivery of digital products zelectronic funds transfer (EFT) zelectronic trading of stocks zdirect consumer marketing zelectronic data interchange (EDI) zthe Internet revolution

4 Benefits of E-Commerce zAccess to a worldwide customer and/or supplier base zReductions in inventory investment and carrying costs zRapid creation of business partnerships to fill emerging market niches zReductions in retail prices through lower marketing costs zReductions in procurement costs zBetter customer service

5 Local Area Network (LAN) zA federation of computers located close together (on the same floor or in the same building) linked together to share data and hardware zThe physical connection of workstations to the LAN is achieved through a network interface card (NIC) which fits into a PC’s expansion slot and contains the circuitry necessary for inter-node communications. zA server is used to store the network operating system, application programs, and data to be shared.

File Server LAN Node Print Server Files Printer

7 Wide Area Network (WAN) zA WAN is a network that is dispersed over a wider geographic area than a LAN. It typically requires the use of: ygateways to connect different types of LANs ybridges to connect same-type LANs zWANs may use common carrier facilities, such as telephone lines, or they may use a Value Added Network (VAN).

LAN Bridge Gateway LAN WAN

9 Star Topology zA network of IPUs with a large central computer (the host) zThe host computer has direct connections to smaller computers, typically desktop or laptop PCs. zThis topology is popular for mainframe computing. zAll communications must go through the host computer, except for local computing.

Local Data Central Data POS TopekaSt. Louis Kansas City Dallas Tulsa Star Network

11 Hierarchical Topology zA host computer is connected to several levels of subordinate smaller computers in a master-slave relationship. Production Planning System Production Scheduling System Regional Sales System Warehouse System Warehouse System Production System Production System Sales Processing System Sales Processing System Sales Processing System Corporate Level Regional Level Local Level

12 Ring Topology zThis configuration eliminates the central site. All nodes in this configuration are of equal status (peers). zResponsibility for managing communications is distributed among the nodes. zCommon resources that are shared by all nodes can be centralized and managed by a file server that is also a node.

Server Ring Topology Local Files Local Files Local Files Local Files Local Files Central Files

14 Bus Topology zThe nodes are all connected to a common cable - the bus. zCommunications and file transfers between workstations are controlled by a server. zIt is generally less costly to install than a ring topology.

Server Bus Topology Node Local Files Node Central Files Print Server

16 Client-Server Topology zThis configuration distributes the processing between the user’s (client’s) computer and the central file server. zBoth types of computers are part of the network, but each is assigned functions that it best performs. zThis approach reduces data communications traffic, thus reducing queues and increasing response time.

Server Client-Server Topology Client Record Searching Capabilities Data Manipulation Capabilities Clien t Data Manipulation Capabilities Data Manipulation Capabilities Data Manipulation Capabilities Data Manipulation Capabilities Common Files

18 Network Control Objectives zestablish a communications session between the sender and the receiver zmanage the flow of data across the network zdetect errors in data caused by line failure or signal degeneration zdetect and resolve data collisions between competing nodes

POLLING METHOD OF CONTROLLING DATA COLLISIONS MASTER Locked Polling Signal Data Transmission One Site, the “master,” polls the other “slave” sites to determine if they have data to transmit. If a slave responds in the affirmative, the master site locks the network while the data are transmitted. Allows priorities to be set for data communications across the network SLAVE WAN

Server Token Ring Node Central Files Local Files Contains data Empty token

21 Carrier Sensing zA random access technique that detects collisions when they occur zThis technique is widely used--found on Ethernets. zThe node wishing to transmit “listens” to the line to determine if it is in use. If it is, it waits a pre-specified amount of time to transmit. zCollisions occur when two nodes listen, hear no messages transmitting, and then simultaneously begin transmitting. The data collides and the two nodes are instructed to hang up and try again. zDisadvantage: The line may not be used optimally when multiple nodes are trying to transmit simultaneously.

22 What is Electronic Data Interchange? zThe exchange of business transaction information: ybetween companies yin a standard format (ANSI X.12 or EDIFACT) yvia a computerized information system zIn “pure” EDI systems, human involvements is not necessary to approve transactions.

23 Communications Links zCompanies may have internal EDI translation/communication software and hardware. OR zThey may subscribe to VANs to perform this function without having to invest in personnel, software, and hardware.

EDI System Purchases System EDI Translation Software EDI Translation Software Communications Software Communications Software Other Mailbox Other Mailbox Company A’s mailbox Company B’s mailbox Sales Order System Application Software Application Software Direct Connection VAN Company A Company B

25 Advantages of EDI zReduction or elimination of data entry zReduction of errors zReduction of paper zReduction of paper processing and postage zReduction of inventories (via JIT systems)

26 The Internet: An Overview zA large network comprised of over 100,000 interconnected smaller networks located around the world yIncludes WWW, Extranets, Intranets, VPNs, LANs, WANs, and VANs zEmploys communications technologies based on packet switching, whereby messages are divided into small packets for transmission

27 The Internet Business Model zInformation level--using the Internet to display and make accessible information about the company, its products, services, and business policies zTransaction level--using the Internet to accept orders from customers and/or to place them with their suppliers zDistribution level--using the Internet to sell and deliver digital products to customers

28 Protocol Functions zThey facilitate the physical connection between the network devices. zThey synchronize the transfer of data between physical devices. zThey provide a basis for error checking and measuring network performance. zThey promote compatibility among network devices. zThey promote network designs that are flexible, expandable, and cost-effective.

29 Internet Protocols zTransfer Control Protocol/Internet Protocol (TCP/IP) - controls how individual packets of data are formatted, transmitted, and received zHypertext Transfer Protocol (HTTP) - controls web browsers zFile Transfer Protocol (FTP) - used to transfer files across the Internet zSimple Network Mail Protocol (SNMP) - zSecure Sockets Layer (SSL) and Secure Electronic Transmission (SET) - encryption schemes

30 Open System Interface (OSI) zThe International Standards Organization developed a layered set of protocols called OSI. zThe purpose of OSI is to provide standards by which the products of different manufacturers can interface with one another in a seamless interconnection at the user level.

The OSI Protocol Layer 1 Physical Layer 2 Data Link Layer 3 Network Layer 4 Transport Layer 5 Session Layer 6 Presentation Layer 7 Application SOFT WARE HARD WARE Layer 1 Physical Layer 2 Data Link Layer 3 Network Layer 4 Transport Layer 5 Session Layer 6 Presentation Layer 7 Application SOFT WARE HARD WARE Data Manipulation Tasks Data Communications Tasks Communications Channel NODE 1 NODE 2

32 Areas of General Concern zData Security: Are stored and transmitted data adequately protected? zBusiness Policies: Are policies publicly stated and consistently followed? zPrivacy: How confidential are customer and trading partner data? zBusiness Process Integrity: How accurately, completely, and consistently does the company process its transactions?

33 Intranet Risks zIntercepting Network Messages ysniffing: interception of user IDs, passwords, confidential s, and financial data files zAccessing Corporate Databases yconnections to central corporate databases increase the risk that data will be viewed, corrupted, changed, or copied by employees zUncontrolled Expansion yill-conceived network decisions create a serious threat

34 Internet Risks to Consumers zHow serious is the risk? yNational Consumer League: Internet fraud rose by 600% between 1997 and 1998 ySEC: complaints alleging fraud rose from 12 per day in 1997 to per day in 1999 zMajor areas of concern: yTheft of Credit Card Numbers yTheft of Passwords yConsumer Privacy--cookies

35 Internet Risks to Businesses zIP Spoofing: masquerading to gain access to a Web server and/or to perpetrate an unlawful act without revealing one’s identity zTechnology Failures: disruption caused by hardware failure causes an e-business to lose both customer credibility and sales revenues zMalicious Programs: viruses, worms, logic bombs, and Trojan horses pose a threat to both Internet and Intranet users

Denial of Service Attack Sender Receiver Step 1: SYN messages Step 2: SYN/ACK Step 3: ACK packet code In a DOS Attack, the sender sends hundreds of messages, receives the SYN/ACK packet, but does not respond with an ACK packet. This leaves the receiver with clogged transmission ports, and legitimate messages cannot be received.

37 E-Commerce Security: Data Encryption zEncryption - A computer program transforms a clear message into a coded (ciphertext) form using an algorithm Encryption Program Encryption Program Ciphertext Communication System Communication System Key Cleartext Message Cleartext Message

Public and Private Key Encryption Public Key is used for encoding messages. Message A Message BMessage CMessage D Ciphertext Multiple people may have the public key (e.g., subordinates). Private Key is used for decoding messages. Typically one person or a small number of people have the private key (e.g., a supervisor). Message AMessage DMessage CMessage B

39 E-Commerce Security: Digital Authentication zDigital signature: electronic authentication technique that ensures that the transmitted message originated with the authorized sender and that it was not tampered with after the signature was applied zDigital certificate: like an electronic identification card that is used in conjunction with a public key encryption system to verify the authenticity of the message sender

40 E-Commerce Security: Firewalls zFirewalls - software and hardware that provide a focal point for security by channeling all network connections through a control gateway zNetwork level firewalls - low cost/low security access control. Uses a screening router to its destination. This method does not explicitly authenticate outside users. Hackers may penetrate the system using an IP spoofing technique. zApplication level firewalls - high level/high cost customizable network security. Allows routine services and to pass through, but can perform sophisticated functions such as logging or user authentication for specific tasks.

41 Assurance z“Trusted” third-party organizations offer seals of assurance that businesses can display on their Web site home pages: yBBB yTRUSTe yVeri-Sign, Inc yICSA yAICPA/CICA WebTrust yAICPA/CICA SysTrust

42 The New Auditing Paradigm zContinuous Process Auditing yauditors review transactions at frequent intervals or as they occur yintelligent control agents: heuristics that search electronic transactions for anomalies zElectronic Audit Trails yelectronic transactions generated without human intervention yno paper audit trail