1

E-Commerce SecurityPart II – Security Techniques

2

Objectives

• Specific security objectives for protecting– Web business assets and customer privacy– client computers from security threats– information as it travels through the Internet

communication channel– the security of Web server computers

• Organizations that promote computer, network, and Internet security

3

Security in Computer IS

• Customers engaging in electronic commerce need to feel confident that their transactions are secure from prying eyes and safe from alteration.

• The security policy must be regularly revised as threat conditions change.

• A security policy must protect a system’s privacy, integrity, and availability and authenticate users.

4

Protecting Electronic Commerce Assets

5

Protecting Privacy

• Cookies contain private information that can include credit card data, passwords, and login information.

• The best way to protect your privacy is to disable cookies entirely.

6

7

Protecting Client Computers

• Client computers must be protected from threats.

• Active content can be one of the most serious threats to client computers.

8

Monitoring Active Content

• Netscape Navigator and Microsoft Internet Explorer browsers are equipped to recognize when they are about to download Web page containing active content.

• When a user downloads Web pages and runs programs that are embedded in them, it gives the user a chance to confirm that the programs are from a known and trusted source.

9

Microsoft Internet Explorer

10

Digital Certificates

• A digital certificate verifies that a user or Web site is who it claims to be.

• The digital certificate contains a means for sending an encrypted message to the entity that sent the original Web page or message.

• A Web site’s digital certificate is a shopper’s assurance that the Web site is the real store.

11

Digital Certificates

12

Using Antivirus Software

• Antivirus software is a defense strategy.

• One of the most likely places to find a virus is in an electronic mail attachment.

• Some Web e-mail systems let users scan attachments using antivirus software before downloading e-mail.

13

Communication Channel Security

• Integrity violations can occur whenever a message is altered while in transit between the sender and receiver.

• Ensuring transaction integrity, two separate algorithms are applied to a message:• Hash function• Digital signature

14

Hash Functions• A hash function creates a fixed length number – often

128 bits (16 characters) long – that summarizes the message content.

• Hash algorithms are one-way functions.

• A hash algorithm has these characteristics:• It uses no secret key.• The message digest cannot be inverted to produce

the original information.• The algorithm and information about how it works

are publicly available.

15

Digital Signature• A message’s computed number is called a message

digest.

• An encrypted message digest is called a digital signature.

• A purchase order accompanied by the digital signature provides the merchant positive identification of the sender and assures the merchant that the message was not altered.

• Used together, public-key encryption, message digests, and digital signatures provide quality security for Internet transactions.

16

Digital Signatures

17

Encryption• Encryption is the coding of information by a

mathematically based program and a secret key to produce a string of characters that is unintelligible.

• The science that studies the encryption is called cryptography (krupto and grafh)

• The program that transforms text into cipher text is called an encryption program.

• Upon arrival, each message is decrypted using a decryption program.

18

Three Types of Encryption

• “Hash coding” is a process that uses a hash algorithm to calculate a hash value from a message.

• “Asymmetric encryption,” or public-key encryption, encodes messages by using two mathematically related numeric keys: a public key and a private key.

• “Symmetric encryption,” or private-key encryption, encodes a message using a single numeric key to encode and decode data.

19

Encryption Methods

20

Encryption: Symmetric

MakikoTakao

Message

Public Keys

Makiko 29Takao 17

Message

Encrypted

Private Key13 Private Key

37UseTakao’sPublic key

UseTakao’sPrivate key

Makiko sends message to Takao that only he can read.

21

Asymmetric: Authentication

Makiko

TakaoPublic Keys

Makiko 29Takao 17

Private Key13

Private Key37

UseTakao’sPublic key

UseTakao’sPrivate key

Takao sends message to Makiko:His key guarantees it came from him.Her key prevents anyone else from reading message.

Message

Message

Encrypt+T

Encrypt+T+M

Encrypt+M

UseMakiko’s

Public key

UseMakiko’s

Private key

Transmission

22

Encryption Standards• The Data Encryption Standard (DES) is an

encryption standard adopted by the U.S. government.

• DES is the most widely used private-key encryption system.

• Triple Data Encryption Standard (3DES) is a more robust version of DES.

• The U.S. government’s National Institute of Standards and Technology (NIST) has developed a new encryption standard.

23

Encryption Algorithms and Standards

24

Secure Sockets Layer (SSL) Protocol

• The SSL system from Netscape is a system that provides secure information transfer through the Internet.

• The SSL encrypts and decrypts information flowing between the two computers.

• All communication between SSL-enabled clients and servers is encoded.

25

Secure Sockets Layer (SSL) Protocol

• The protocol that implements SSL is HTTPS.

• A session key is a key used by an encryption algorithm during a single secure session.

• The longer the session key, the more resistant the encryption is to attack.

• The algorithm may be DES, Triple DES, or the RAS encryption algorithm.

26

Secure HTTP (S-HTTP) Protocol

• The headers define the type of security techniques, including:• The use of private-key encryption• Server authentication• Client authentication• Message integrity

• A secure envelope encapsulates a message and provides secrecy, integrity, and client/server authentication.

27

Protecting the Web Server

• Security solutions for commerce servers:• Access control and authentication• Operating system controls• Firewall

28

Access Control & Authentication

• Access control and authentication refers to controlling who and what has access to the commerce server.

• Authentication is performed using digital certificates.

• Web servers often provide access control list security to restrict file access to selected users.

29

Access Control & Authentication

• The server can authenticate a user in several ways:• First, the certificate represents the user’s

admittance voucher.• Second, the sever checks the timestamp on the

certificate to ensure that the certificate has not expired.

• Third, a server can use a callback system to check the user’s client computer address and name.

• An access control list (ACL) is a list or database of people who can access the files and resources.

30

Access Control and Authentication

31

Dial Back Modem

phonecompany

phonecompany

1

63

7 2

5

4

Jones 1111Smith 2222Olsen 3333Araha 4444

1) User calls computer.2) Modem answers.3) User enters name and password.4) Modem hangs up.5) Modem dials phone number in database.6) User machine answers.7) User gets access.

If hacker somehow gets name and password. Company modem will hang up and call back number in database, preventing hacker from accessing the computer.

32

Operating System Controls

• Most operating systems have a username and password as well as a user authentication system in place.

• Access control lists and username/password protections are probably the best known of the UNIX security features.

33

User Identification• Passwords

– Dial up service found 30% of people used same word

– People choose obvious words

• Hints– Don’t use real words, personal names– Include non-alphabetic– Change often– Use at least 6 characters

34

• Alternatives: Biometrics– Finger/hand print– Voice recognition– Retina/blood vessels– Thermal

Biometrics

• Comments– Don’t have to remember– Reasonably accurate– Price is dropping– Nothing is perfect

35

Biometrics: Thermal

Several methods exist to identify a person based on biological characteristics. Common techniques include fingerprint, handprint readers, and retinal scanners. More exotic devices include body shape sensors and this thermal facial reader which uses infrared imaging to identify the user.

36

Firewalls• A firewall is a computer and software

combination that is installed at the entry point of a networked system.

• The firewall provides the first line of defense between a network and the Internet or other network that could pose a threat.

• Acting as a filter, firewalls permit selected messages to flow into and out of the protected network.

37

Types of Firewalls

• Packet-filter firewalls examine all the data flowing back and forth between the trusted network.

• Gateway servers are firewalls that filter traffic based on the application they request.

• Proxy severs are firewalls that communicate with the Internet on the private network’s behalf.

38

Computer Forensics and Ethical Hacking

• A small group of firms whose job is to break into client computers.

• Computer forensics experts are hired to probe PCs.

• The field of computer forensics is for the collection, preservation, and analysis of computer-related evidence.

39

Computer Security Resources

• CERT• SANS Institute• Internet Storm Center• Center for Internet Security• Microsoft Research Security• U.S. Dept. of Justice Cybercrime• National Infrastructure Protection

Center