Chapter 9

E-Commerce Security and Fraud

As you read the textbook and go through this lesson, think about the following questions:

· What are the major forms of Internet crime?

· What are the typical security measures used by e-commerce?

· Why is the Internet vulnerable to attack?

· What concerns might a consumer have when doing business online?

· What concerns might a business have when selling products or services online?

· What are authentication, authorization, and nonrepudiation?

· What are some common Internet attack methods?

· What is phishing?

· What three components can be used to measure security of the e-commerce environment?

· Why is it difficult to stop Internet crime?

Upon completion of this chapter, you will be able to:

1. Understand the importance and scope of security of information systems for EC.

2. Describe the major concepts and terminology of EC security.

3. Learn about the major EC security threats, vulnerabilities, and technical attacks.

4. Understand Internet fraud, phishing, and spam.

5. Describe the information assurance security principles.

6. Identify and assess major technologies and methods for securing EC access and communications.

7. Describe the major technologies for protection of EC networks.

8. Describe various types of controls and special defense mechanisms.

9. Describe consumer and seller protection from fraud.

10. Describe the role of business continuity and disaster recovery planning.

11. Discuss EC security’s enterprisewide implementation issues.

12. Understand why it is not possible to stop computer crimes.

Answers to Pause/Break Section Review Questions

Section 9.1 Review Questions

1. Define computer security.

Computer security refers to the protection of data, networks, computer programs, computer power, and other elements of computerized information systems.

2. List the major findings of the CSI 2010 survey.

· The most expensive computer security incidents were those involving financial fraud.

· Virus incidents occurred most frequently.

· Almost one in ten organizations reported they experienced a domain name system (DNS) incident.

· Twenty-seven percent of those surveyed responded positively to a question regarding “targeted attacks.”

· The vast majority of respondents said their organizations had a security policy.

3. Describe the vulnerable design of the Internet.

The Internet and its network protocols were never intended for use by untrustworthy people or criminals. They were designed to accommodate computer-to-computer communications in a closed and trusted community.

4. Describe some profit-induced computer crimes.

Most popular is the theft of personal information such as credit card numbers, bank accounts, Internet IDs, and passwords.

5. Define the Internet underground economy.

E-markets for stolen information made up of thousands of Web sites that sell credit card numbers, social security numbers, other data such as numbers of bank accounts, social network IDs, passwords, and much more.

6. Describe the dynamic nature of EC systems.

EC systems are changing all the time due to a stream of innovations. With changes often come security problems.

7. What makes EC security management so difficult? What is the dilemma?

The defense of information systems and EC is getting more difficult. The attackers change their strategies and attack methods all the time.

Section 9.2 Review Questions

1. List five major terms of EC security.

· Business continuity plan

· Cybercrime

· Exposure

· Fraud

· Malware (malicious software)

· Phishing

· Risk

· Social engineering

· Spam

· Vulnerability

· Zombie

2. Describe the major unintentional security hazards.

· Human error. Human error can occur in the design of the hardware or information system.

· Environmental hazards. These include earthquakes, severe storms (e.g., hurricanes, blizzards, or sand), floods, power failures or strong fluctuations, fires (the most common hazard), explosions, radioactive fallout, and water-cooling system failures.

· Defects in the computer system. Defects can be the result of poor manufacturing, defective materials, and outdated or poorly maintained networks.

3. List five examples of intentional EC security crimes.

· theft of data or hardware (e.g., laptops)

· inappropriate use of data

· deliberate manipulation in handling, entering, processing, transferring, or programming data

· vandalism

· sabotage

· malicious damage to computer resources

· destruction from viruses

· Internet fraud

4. Describe the security battleground, who participates, and how. What are the possible results?

This battleground includes:

· The attacks, the attackers, and their strategies

· The items that are being attacked

· The defenders and their methods and strategy

Each uses their tools to exert control, one group wins each battle.

5. Define hacker, cracker, and social engineering.

· Hacker – someone who gains unauthorized access to a computer system

· Cracker – a malicious hacker, who may represent a serious problem for a corporation

· Social engineering – a collection of tactics used to manipulate people into performing actions or divulging confidential information

6. List all security requirements and define authentication and authorization requirements.

· Authentication – process to verify (assure) the real identity of an individual, computer, computer program, or EC Web site

· Authorization – process of determining what the authenticated entity is allowed to access and what operations it is allowed to perform

7. What is nonrepudiation?

Assurance that online customers or trading partners cannot falsely deny (repudiate) their purchase or transaction.

8. Describe deterring, preventing, and detecting in EC security systems.

· Deterring measures – actions that will make criminals abandon their idea of attacking a specific system (e.g., the possibility of losing a job for insiders)

· Prevention measures – ways to help stop unauthorized users (also known as “intruders”) from accessing any part of the EC system

· Detection measures – ways to determine whether intruders attempted to break into the EC system, whether they were successful, and what they may have done

9. What is a security strategy, and why it is needed?

A security strategy is an overriding plan for maintaining IS security within an organization. From it all other security plans arise.

Section 9.3 Review Questions

1. Describe the difference between a nontechnical and a technical cyber attack?

A technical attack uses IT technology, whereas a nontechnical attack uses (or attacks) standard security measures.

2. What are the major forms of malicious code?

· Viruses

· Worms

· Macro viruses and worms

· Trojan horses

3. What factors account for the increase in malicious code?

· Mixing applications with executable code

· Homogenous computing environments

· Connectivity

· Uneducated users

4. Define a virus and explain how it works.

A piece of software code that inserts itself into a host, including the operating systems, in order to propagate; it requires that its host program be run to activate it.

5. Define worm and Trojan horse.

Worm – a software program that runs independently, consuming the resources of its host in order to maintain itself, and is capable of propagating a complete working version of itself onto another machine

Trojan horse – a program that appears to have a useful function but contains a hidden function that presents a security risk

6. Define DoS. How are DOS attacks perpetrated?

An attack on a Web site in which an attacker uses specialized software to send a flood of data packets to the target computer with the aim of overloading its resources. A denial of service attack occurs when an attacker gains illegal administration access to as many computers on the Internet as possible and uses these multiple computers to send a flood of data packets to a target computer.

7. Define server and page hijacking.

Gaining control of a web server or creating a rogue copy of a popular Web site that shows contents similar to the original to a Web crawler. Once there, an unsuspecting user is redirected to malicious Web sites.

8. Describe botnet attacks.

A huge number (e.g., hundreds of thousands) of hijacked Internet computers are set up to forward traffic, including spam and viruses, to other computers on the Internet.

Section 9.4 Review Questions

1. Define phishing.

The criminal, fraudulent process of attempting to acquire confidential information such as user names, passwords, and credit card details by masquerading as a trustworthy entity such as a well-known bank, credit card company, a large social network, or a telecommunication company, in an electronic communication, usually via e-mail or IM.

2. Describe the relationship of phishing to financial fraud.

In many cases, phishing leads to financial fraud.

3. Briefly describe some phishing tactics.

Attackers pretend to be from reputable firms, and ask users to provide personal information as a part of an existing relationship.

4. Describe spam and its methods.

Spam is sending or posting a large number of emails or other electronic records indiscriminately.

5. Define splogs and explain how sploggers make money.

Short for spam blog, a splog is a site created solely for marketing purposes. These sites steal content from other blogs with the hope of increasing their search engine hits, which in turn increases the value of any advertising they have.

6. Why and how are social networks being attacked?

Social networks can be attacked in much the same way as individuals and Web site currently are. They are an inviting target due to their size and growth.

Section 9.5 Review Questions

1. What is information assurance? List its major components.

Information assurance is the protection of information against unauthorized access or modification. Its components include:

· Confidentiality

· Integrity

· Availability

· Authentication

· Authorization

· Nonrepudiation

2. Define confidentiality, integrity, and availability.

· Confidentiality – assurance of data privacy and accuracy; keeping private or sensitive information from being disclosed to unauthorized individuals, entities, or processes

· Integrity – assurance that stored data has not been modified without authorization; a message that was sent is the same message that was received

· Availability – assurance that access to data, the Web site, or other EC data service is timely, available, reliable, and restricted to authorized users

3. Define authentication, authorization, and nonrepudiation.

· Authentication requires evidence in the form of credentials.

· Authorization requires comparing information about the person or program with access control information associated with the resource being accessed.

· Nonrepudiation is the concept of ensuring that a party in a dispute cannot repudiate or refute the validity of a statement or contract.

4. List the six objectives of EC strategy.

· Prevention and deterrence.

· Detection.

· Containment (contain the damage).

· Recovery.

· Correction.

· Awareness and compliance.

5. Discuss the gap between security spending and a company’s security needs gap.

Because of the constantly changing threats, it is difficult to keep up with the costs of security.

6. Describe vulnerability assessment.

The process of identifying, quantifying, and prioritizing the vulnerabilities in a system.

7. List the six categories of defense in EC systems.

· Defending access to computing systems, data flow, and EC transactions

· Defending EC networks

· General, administrative, and application controls

· Protection against social engineering and fraud

· Disaster preparation, business continuity, and risk management

· Implementing enterprise-wide security programs

Section 9.6 Review Questions

1. Define access control.

Mechanism that determines who can legitimately use a network resource.

2. What are the basic elements of an authentication system?

· A group or person to be authenticated

· A distinguishing characteristic

· A system proprietor

· Authentication mechanism

· Access control mechanism

3. Define biometric systems and list five of their methods.

Authentication systems that identify a person by measurement of a biological characteristic, such as fingerprints, iris (eye) patterns, facial features, or voice. Example methods include:

· Thumbprint or fingerprint

· Retinal scan

· Voice scan

· Signature

· Facial recognition

4. Define a symmetric (one-key) encryption.

An encryption system that uses the same key to encrypt and decrypt the message.

5. List some of the disadvantages of the symmetric system.

One disadvantage is that the security of the message as a whole is based on a single key, and that the message cannot be verified against a second key.

6. What are the key elements of PKI?

A pair of matched keys – a public key to encrypt a message and a private key to decrypt it, or vice versa

7. Describe the PKI process.

The process is detailed in Exhibit 9.11.

8. What role does a certificate authority play?

It is a verification that the holder of a public or private key is who they claim to be. These certificates are issued by certificate authorities.

Section 9.7 Review Questions

1. List the basic types of firewalls and briefly describe each.

Packet-filtering routers – firewalls that filter data and requests moving from the public Internet to a private network based on the network addresses of the computer sending and receiving the request

Application-level proxies – firewall that permits requests for Web pages to move from the public Internet to the private network

2. What is a personal firewall? What is DMZ architecture?

A network node designed to protect an individual user’s desktop system from the public network by monitoring all the traffic that passes through the computer’s network interface card. DMZ is a popular defense system that includes two firewalls.

3. How does a VPN work what are its benefits to users?

A VPN is a network that uses the public Internet to carry information but remains private by using encryption to scramble the communications, authentication to ensure that information has not been tampered with, and access control to verify the identity of anyone using the network. It allows users to safely access protected network assets.

4. Briefly describe the major types of IDSs.

Audit logs – show attempted logins and system use

Host-based IDS – watches for unauthorized file changes

Network-based IDS – examines network traffic

5. What is a honeynet? What is a honeypot?

Honeynet – method of evaluating vulnerabilities of a system using honeypots

Honeypot – systems used to study network intrusions

6. Describe e-mail security.

Complete e-mail security can include:

· Antivirus and antispam

· E-mail encryption

· Outbound filtering

7. How can cloud computing help?

Cloud computing provides for better data integrity, while reducing costs.

Section 9.8 Review Questions

1. What are general controls? List the various types.

Controls established to protect the system regardless of the specific application. For example, protecting hardware and controlling access to the data center are independent of the specific application.

2. What are administrative controls?

Administrative controls deal with issuing guidelines and monitoring compliance with the guidelines.

3. Define application controls.

Controls that are intended to protect specific applications.

4. How does one protect against spam?

Companies can protect against spam by filtering email and working with providers on policies.

5. How does one protect against pop-ups?

Generally, through the use of pop-blocking tools in browsers and toolbars.

6. How does one protect against phishing, spyware, and malvertising?

These can be protected against through a combination of security applications and education.

Section 9.9 Review Questions

1. Why do organizations need a business continuity plan?

The purpose of a business continuity plan is to keep the business running after a disaster occurs. Each function in the business should have a valid recovery capability plan.

2. List three issues a business continuity plan should cover.

· Understand business & IT requirements

· Evaluate current capabilities

· Develop continuity plan

3. Identify two factors that influence a company’s ability to recover from a disaster.

Two examples include proper planning and asset protection.

4. What types of devices are needed for disaster avoidance?

A variety of options are available to help avoid disasters. The simplest is the use of uninterrupted power supply (UPS) systems to help avoid issues created by power outages.

5. How can you calculate expected loss?

Using risk management analysis, it is possible to estimate losses based on different scenarios.

6. List two ethical issues associated with security programs.

Examples include constant monitoring of activities and possible invasion of privacy.

Section 9.10 Review Questions

1. If senior management is not committed to EC security, how might that impact the e-business?

Student answers will vary, but lack of management support generally leads to the failure of an initiative.

2. What is a benefit of using the risk exposure model for EC security planning?

It allows the firm to allocate capital at the areas of greatest organizational importance.

3. Why should every company implement an acceptable use policy?

Student responses will vary, but these policies help to define parameters and are useful in planning.

4. Why is training required?

Since systems are unique and changing, it is important to train staff on their acceptable use and policy.

5. List the six major reasons why it is difficult to stop computer crimes.

· Would Make Shopping Inconvenient

· Lack of Cooperation from Credit Card Issuers

· Shoppers’ Negligence

· Design and Architecture Issues

· Ignoring EC Security Best Practices

· Lack of Due Care in Business Practices

Answers to EC Application Case Questions

EC Application Case 9.1:

INTERNET STOCK FRAUD AIDED BY SPAM

1. Why might people buy the penny stocks promoted in an e-mail message from an unknown source?

Individuals may be looking to make some quick, easy money.

2. Use Google or Bing to find out what can be done to filter image spam.

Student searches and results will vary.

EC Application Case 9.2:

BUSINESS CONTINUITY AND DISASTER RECOVERY

1. Why might a company that had a significant data loss not be able to recover?

They may be completely unable to recreate the information that was lost.

2. Why are regulators requiring that companies implement BC/DR plans?

To ensure that companies are able to recover, and fulfill their obligations.

Answers to Discussion Questions

1. Consider how a hacker might trick people into giving him their user IDs and passwords to their Amazon.com accounts. What are some of the ways that a hacker might accomplish this? What crimes can be performed with such information?

Student responses will vary. The most common approach would probably be a phishing email, indicating a need to “verify” account information by going to a false Web site.

2. B2C EC sites continue to experience DOS attacks. How are these attacks perpetrated? Why is it so difficult to safeguard against them? What are some of the things a site can do to mitigate such attacks?

DOS attacks come from many computers (zombies) at the same time. It is therefore difficult to isolate just the attacker’s IP address and shut off traffic from it. Use of a firewall may help mitigate these attacks.

3. How are botnet identity theft attacks and Web site hijacks perpetrated? Why are they so dangerous to e-commerce?

Student answers will vary. Attacks are generally perpetrated by infecting large numbers of computer systems (botnets) or controlling data entering and exiting other Web sites (hijacks). Both are dangerous because they steal personal information that can later be used for identity theft. This represents a danger to EC because it pushes away potential customers.

4. Discuss some of the difficulties of eliminating online financial fraud.

The primary difficulties are the constantly changing attacks, and individuals lack of understanding of security.

5. Some companies prefer not to have disaster recovery plans. Under what circumstances does this make sense? Discuss.

This does not make sense, all companies should be able to recover their data in the event of an emergency.

6. Enter idesia-biometrics.com and look at its product. Discuss these benefits over other biometrics.