Enhancing E-Commerce Security Needs Overview

Lesson 19-E-Commerce Security Needs

Overview • Understand e-commerce services. • Understand the importance of availability. • Implement client-side security. • Implement server-side security. • Implement application security. • Implement database server security. • Develop an e-commerce architecture.

Understand E-Commerce Services • Organizations perform e-commerce to make profit by providing goods and services at a lower cost. • Providing electronic library functions for sensitive or confidential information has come with the advent of e-commerce over the Internet.

Understand E-Commerce Services • E-commerce service is most commonly thought of as the purchasing of goods. • Security to e-commerce services can be measured by its confidentiality, integrity, and accountability.

Understand E-Commerce Services • E-Commerce Services and regular DMZ Services differ in their requirements. • Requirement of verification and confidentiality differentiate the e-commerce services from regular DMZ services. • Availability becomes a critical security issue for the e-commerce site.

Understand E-Commerce Services • E-commerce services may involve selling goods, providing confidential information, or distribution of information. • Security to e-commerce services can be measured in terms of confidentiality, integrity, and accountability.

Understand the Importance of Availability • Availability is the key issue for e-commerce services. • Availability of the site has a direct impact on the confidence a customer will have in using the service. • Failure in availability is almost guaranteed to push a potential customer to a competitor.

Understand the Importance of Availability Business-to-consumer issues: • The entire site along with payment processing must be up at all times. • Problem of availability includes business issues such as ability of the organization to fulfill orders entered into the system. • Size of the infrastructure must be built according to the expected load.

Understand the Importance of Availability Business-to-business issues: • Business-to-business e-commerce is established between two organizations that have some type of relationship. • Availability issues may be more stringent in Business-to-business e-commerce. • When one organization needs to make an order, the other organization must be able to receive and process it.

Understand the Importance of Availability Global time: • E-commerce availability is governed by the concept of global time. • This concept identifies the global nature of the Internet and of e-commerce. • An e-commerce site must be able to handle orders from unexpected locations.

Understand the Importance of Availability Client comfort: • Client must feel comfortable with the ability of the organization to process orders and deliver goods. • Customer comfort or discomfort can multiply quickly.

Understand the Importance of Availability Cost of downtime: • The cost of downtime is high. • It can be measured by taking the average number of transactions over a period of time and the revenue of the average transaction. • An e-commerce site must not have single points of failure. • The site should also have procedures for updating hardware and software.

Understand the Importance of Availability Solving the availability problem: • Downtime can be reduced through redundancy. • For sites that expect large amounts of traffic, load-balancing application layer switches can be used. • Network infrastructure components must also be configured to fail-over if high availability is required.

Implement Client-Side Security Client-side security components

Implement Client-Side Security • Client-side security deals with the security from the customer’s desktop system to the e-commerce server. • A realistic solution to communications security is encryption of information.

Implement Client-Side Security • A cookie is a small amount of information that is stored on the client system by the Web server in cleartext or encrypted. • Organizations must ensure that a legitimate customer places the order to reduce possible repudiation.

Implement Server-Side Security Security of servers includes: • Information stored on the server. • Protecting the server from attack.

Information Stored on the Server • An e-commerce server is a semi-trusted or untrusted system which should not store sensitive information. • If information is kept on the e-commerce server, it should be protected from unauthorized access through file access controls.

Protecting the Server from Attack Three categories in protecting an e-commerce server from attack: • Server location. • Operating system configuration. • Web server configuration.

Server Location • Server should be located in a protected area such as a data center. • If the server is placed at a co-location facility, physical access to it must be separated from other clients. • Firewall should be configured to only allow access to e-commerce server on ports 80 (for HTTP) and 443 (for HTTPS).

Operating System Configuration • The first step in configuring the server securely is to remove or turn off any unnecessary services. • The latest patches must be checked and loaded for the chosen operating system. • The system should meet the organization’s policy and vulnerability scan should be conducted.

Web Server Configuration • Web server must not be run as root or administrator for security. • CGI scripts on Web server that are not being used should be removed to prevent intruder attack. • Web server should be scanned for known vulnerabilities.

Implement Application Security • Security of e-commerce application as a whole is the most important part of e-commerce security. • Security requirements should be included in the requirements definition phase of project. • Security requirements include requirements pertaining to protection, authentication, audit, availability, and identifying sensitive information.

Implement Application Security • All sensitive information needs to be protected. • Programs are a major source of system vulnerabilities due to programming errors. • Buffer overflows can be reduced by not making assumptions about the size of user input and not passing unchecked user input to shell commands. • Peer review or code review can catch many programming errors before the server goes into production.

Implement Application Security • Vulnerability scanners should detect buffer overflow problems before the site goes into production. • The two parts of configuration management are control of authorized changes and identification of unauthorized changes. • To prevent false alarms, checksum should be updated during configuration management procedure.

Implement Database Server Security • The database server may contain sensitive and confidential information which should be protected. • Organizations must examine database location, communication with e-commerce server, and internal access protection. • Database servers must be kept in controlled areas. • The e-commerce server should initiate SQL connection to the database server for processing transactions.

Implement Database Server Security • The e-commerce server must have an ID and password to initiate an SQL connection to the database server. • Employees of the organization have access to internal network and thus are able to directly attack it. • Database server could be moved to a separate network and protected by an internal firewall.

Develop an E-Commerce Architecture • A high-traffic and high-availability e-commerce site requires two ISPs with fail-over capability. • Routers, switches, and firewalls should be cross-connected so that failure of any one component will not affect traffic. • Redundant switches may be used to ensure availability of the site. • Regular vulnerability scans and database auditing must be conducted.

Summary • E-commerce service providers can increase revenue by providing information to customers at a lower cost. • Security with respect to confidentiality, integrity, and accountability plays a major role in e-commerce. • Availability is a key issue for e-commerce. • Client-side security protects information in transit, information stored on customer’s computer, and prevents repudiation.

Summary • Server-side security involves protection of information stored on the server and protection of the server itself. • Security of the e-commerce application as a whole is probably the most important part of e-commerce security. • Confidential and sensitive information present in the database server must be protected.

Enhancing E-Commerce Security Needs Overview