Transcript Chapter 5

Security Threats to
Electronic Commerce
Learning Objectives
In this chapter, you will learn about:
• Important computer and electronic
commerce security terms
• The reason that secrecy, integrity, and
necessity are three parts of any security
program
• The roles of copyright and intellectual
property and their importance
• Threats and countermeasures to
eliminate or reduce threats
-ALM AY-
2
Learning Objectives
• Specific threats to client machines,
Web servers, and commerce servers
• Methods that you can use to enhance
security in back office products
• The way in which security protocols
help plug security holes
• The roles that encryption and
certificates play in assurance and
secrecy
-ALM AY-
3
Security Overview
• Computer security is the protection
of assets from unauthorized access,
use, alteration, or destruction.
• Two types of security:
– Physical security
– Logical security
-ALM AY-
4
Types of Security
• Physical security includes tangible
protection devices such as alarms
and guards.
• Protection of assets using
nonphysical means is called logical
security.
-ALM AY-
5
Implication of Threat
• Any act or object that poses a
danger to computer assets is known
as a threat.
• Countermeasure is a procedure that
recognizes, reduces, or eliminates a
threat.
-ALM AY-
6
Computer Security
Classification
• Three computer security categories:
– Secrecy
– Integrity
– Necessity
• Secrecy refers to protecting against unauthorized
data disclosure and ensuring the authenticity of the
data’s source.
• Integrity refers to preventing unauthorized data
modification.
• Necessity refers to preventing data delays or
denials.
-ALM AY7
Copyright and Intellectual
Property
• Copyright is the protection of
expression.
• Intellectual property is the ownership
of ideas and control over the tangible
or virtual representation of those ideas.
• U.S. Copyright Act of 1976, in SL ?
(www.icta.lk)
• Copyright Clearance Center provides
copyright information
-ALM AY-
8
Security Policy and Integrated
Security
• A security policy is a written
statement describing:
– Which assets to protect and why to
protect
– Who is responsible for that protection
– Which behaviors are acceptable and
which are not
-ALM AY-
9
Elements of a Security Policy
•
•
•
•
•
Authentication
Access control
Secrecy
Data integrity (reliability)
Audit
-ALM AY-
10
Intellectual Property
Threats
• Copyright infringements on the Web
occur because users are ignorant of
what they can and cannot copy.
• The Copyright Website tackles the
issues of copyright and newsgroup
postings and fair use.
-ALM AY-
11
Music Online
• Music industry better illustrates the
copyright and intellectual property
issues.
• Napster changed the way music is
delivered.
• The act of ripping a song without
proper permission is a copyright
violation.
-ALM AY-
12
Domain Names
• Issues of intellectual property rights
on Internet Domain Names:
– Cyber squatting
– Name changing
– Name stealing
-ALM AY-
13
Cyber squatting
• Cybersquatting is the practice of
registering a domain name that is the
trademark of another person or
company in the hopes that the owner
will pay huge amounts of money to
acquire the URL.
• On November 29, 1999, the U.S. Anticyber-squating Consumer Protection
Act was signed into law.
-ALM AY-
14
Name Changing
• Name changing occurs when someone
registers purposely misspelled
variations of well-known domain
names.
• The practice of name changing is
annoying to affected online businesses
and confusing to their customers.
-ALM AY-
15
Name Stealing
• Name stealing occurs when someone
changes the ownership of the domain
name assigned to the site to another
site and owner.
• Once domain name ownership is
changed, the name stealer can
manipulate the site.
-ALM AY-
16
Electronic Commerce
Threats
• There are three types of electronic
commerce threats:
– Client threats
– Communication channel threats
– Server threats
-ALM AY-
17
Client Threats
• Web pages were mainly static.
• The widespread use of active content
has changed the function of Web
pages.
• Sources of client threats:
– Active content
– Java, Java Applets, and JavaScript
– ActiveX Controls
– Graphics, Plug-Ins, and E-mail
Attachments -ALM AY-
18
Active Content
• Active content refers to programs that
are embedded transparently in Web
pages and that cause action to occur.
• The best-known active content forms are
Java applets, ActiveX controls,
JavaScript, and VBScript.
• Also include graphics and Web browser
plug-ins.
-ALM AY-
19
Active Content
• A Trojan horse is a program hidden inside
another program or Web page that masks its
true purpose.
• A zombie is a program that secretly takes
over another computer for the purpose of
launching attacks on other computer.
• Malicious cookie can destroy files stored
on client computers.
-ALM AY-
20
Java
• Java adds functionality to business
applications and can handle transactions and a
wide variety of actions on the client computer.
• Java sandbox confines Java applet actions to a
set of rules defined by the security model.
• Java is a very powerful development language.
Untrusted applets should not be allowed to
access all of this power. The Java sandbox
restricts applets from performing many
activities.
• These rules apply to all untrusted Java applets.
-ALM AY-
21
Java Applets
• Java applets that are loaded from a local
file system are trusted.
• Trusted applets have full access to system
resources on the client computer.
• Signed Java applets contain embedded
digital signatures from a trusted third
party, which are proof of the identity of
the source of the applet.
-ALM AY-
22
JavaScript
• JavaScript is a scripting language to
enable Web page designers to build
active content.
• JavaScript can invoke privacy and
integrity attacks by executing code that
destroys your hard disk.
• JavaScript programs do not operate
under the restrictions of the Java
sandbox security model.
-ALM AY-
23
ActiveX Controls
• ActiveX is an object that contains programs and properties
that Web designers place on Web pages to perform particular
tasks.
• ActiveX controls run only on computers running Windows and
only on browsers that support them.
• Because ActiveX controls have full access to your computer,
they can cause secrecy, integrity, or necessity violations.
• **ActiveX is a set of technologies that enable software
components to interact with one another in a networked
environment, regardless of the language in which the
components were created. An ActiveX control is a user
interface element created using ActiveX technology. ActiveX
controls are small, fast, and powerful, and make it easy to
integrate and reuse software-ALM
components.
AY24
Graphics, Plug-Ins, and E-mail
Attachments
• Graphics, browser plug-ins, and e-mail
attachments can harbor executable content.
• The code embedded in the graphic could be a
potential threat.
• Plug-ins performs their duties by executing
commands buried within the media they are
manipulating.
• E-mail attachments provide a convenient way
to send nontext information over a text-only
system.
-ALM AY-
25
Virus
• A virus is software that attaches itself to
another program and can cause damage when
the host program is activated.
• Worm viruses replicate themselves on other
machines.
• A macro virus is coded as a small program and
is embedded in a file.
• The term steganography describes information
that is hidden within another piece of
information.
-ALM AY-
26
Communication Channel
Threats
• The Internet is not at all secure.
• Messages on the Internet travel a random
path from a source node to a destination
node.
• Internet channel security threats include:
– secrecy
– integrity
– necessity
-ALM AY-
27
Secrecy Threats
• Secrecy is the prevention of unauthorized
information disclosure.
• Privacy is the protection of individual rights to
nondisclosure.
• Secrecy is a technical issue requiring
sophisticated physical and logical mechanism.
• Privacy protection is a legal matter.
-ALM AY-
28
Integrity Threats
• An integrity threat exists when an
unauthorized party can alter a message
stream of information.
• Cyber vandalism is an example of an
integrity violation.
• Masquerading or spoofing is one means of
creating havoc on Web sites.
-ALM AY-
29
Necessity Threats
• The purpose of a necessity threat is to
disrupt normal computer processing or
to deny processing entirely.
• Necessity threat is also known as a delay,
denial, or denial-of-service threat (DOS).
• eBay faced the denial-of-service attack in
early 2000.
-ALM AY-
30
Server Threats
• Servers have vulnerabilities that can be
exploited to cause destruction or to
acquire information illegally.
• Server threats include:
–
–
–
–
Web server threats
Database threats
Common gateway interface threats
Other programming threats
-ALM AY-
31
Web Server Threats
• Setting up a Web server to run in highprivilege status can lead to a Web server threat.
• The secrecy violation occurs when the contents
of a server’s folder names are revealed to a
Web browser.
• The W3C Threat Document provides
information about server security.
Click to see Figure:
-ALM AY-
32
-ALM AY-
33
Database Threats
• Databases connected to the Web could damage
a company if it were disclosed or altered.
• Anyone obtains user authentication
information can masquerade as a legitimate
user.
• The Database threats resource center describes
threats to database systems.
Click to see Figure 5-14:
-ALM AY-
34
-ALM AY-
35
Common Gateway Interface
Threats
• Because CGIs are programs, they present
a security threat if misused.
• CGI scripts can be set up to run with
high privileges, which causes a threat.
• CGI programs or scripts can reside
about anywhere on the Web server, they
are hard to track down and manage.
-ALM AY-
36
Other Programming Threats
• Another serious Web server attack can come
from programs executed by the server.
• Buffer overflows can have moderate to very
serious security consequences.
• A mail bomb is the attack when thousands of
people send a message to a particular address.
Click to see Figure 5-15:
-ALM AY-
37
-ALM AY-
38
CERT
• DARPA created the Computer Emergency
Response Team (CERT) Coordination
Center to be located at Carnegie Mellon
University.
• CERT posts “CERT alerts” to inform the
Internet community about recent security
events.
Click to see Figure 5-16:
-ALM AY-
39
-ALM AY-
40