This is an introduction to the many threats that computer systems and users face on the internet. Methods that users can implement to protect themselves are also explored. Article by Kevin Rio.
The security measures of online retailers vary immensely. The methods used to gather, store, and distribute information is implemented differently across the web. Many companies and corporations that collect sensitive data do not have proper security protocols put into place, which may compromise personal information. Common errors that online businesses make when processing transactions will be analyzed and critiqued.This includes information security and the protocols that they should put into place both in terms of their computer infrastructure, data collection and the establishment of personnel protocols, such as the handling of sensitive information and password changes. The transactions between the client and server will be examined along with the protocols used in the sharing of information, such as secure socket layers and their different certificates, encryption and security measures that are utilized. E-commerce firms must ensure that they control access to their information assets and the use of their networks by designing and implementing controls that will diminish the dissemination of sensitive information. There are possible vulnerabilities on a client’s machine that can lead to data being compromised before it is uploaded to the server. The monitoring of sensitive information, authentication techniques, virus detection tools, fraudulent connection discovery, database storage, encryption techniques, virus and cracking vulnerabilities, and firewall protection will be discussed herein.
There are a multitude of possible scenarios where sensitive data can be stolen or misplaced when processing an online transaction. The methods used to steal and compromise sensitive data is dynamic and ever changing. Their purpose is to target applications and architectures that are widely used, such as instant messaging, email, standardized shopping carts, redundant coding schemes, database programs, and security techniques and encryption. Security concerns should be discussed during the design stages of systems development to ensure it is addressed properly (Chorafas, 2004). One reason for the multitude of security concerns faced by users is that the internet was not developed with security in mind, thus many of the techniques security professionals are putting into place are reactionary and hackers are using these same methods. Traditional E-commerce security can be broken down into a three-tier model where the client, server, and database are described separately (Shwan, 2006). To gather an understanding for the threats against E-Commerce applications, we must also explore security concerns that threaten all systems.
Client Security Overview
Attackers have a few choices when deciding whom to target when attempting to steal sensitive information. They can target the consumer, their computer, the connection between the computer and the E-Commerce site, or the web server and the services that allow it to run properly (Khusial, McKegney, 2005).
The purpose of client side security is to safeguard information stored on a system from individuals and malware that attempt to gain unsanctioned access to data. Protection from this type of unauthorized intrusion must be handled by both software and hardware (Shwan, 2006). The use of biometrics to gain access to systems, secure access controls, and digital signatures are examples of techniques used to ensure client side security. Security methods related to communication should also be addressed at both the local network and internet levels. Clients must ensure that all communications have encryption enabled to safeguard transactions from software, such as spoofer programs, sniffers, Trojans, and backdoors. Consumers’ computers are often targeted because of their relatively scarce security settings (Khusial, McKegney, 2005). Users often disable security settings because of conflicts or computer vendors do not enable them to ensure ease of use.
Secure systems have four categories that they follow to ensure data safeguards (Khusial, McKegney, 2005). First, the system utilizes authentication methods to verify that the user is permitted to utilize the system. Second, authorization dictates how much of the system the user is permitted to use to safeguard certain files and important data. Third, encryption ensures that data cannot be read by users who may be attempting to gather files from a transaction. Lastly, auditing is used to keep logs of all transactions and connections for the purpose of detecting breaches and ensuring that a system is performing efficiently.
Server Security Overview
The majority of experts agree that the most effective way of reducing threats against a server is by separating the web server from the server database and application servers. Due to the web server having a direct connection to the internet, it is the gateway between users and an E-Commerce site, thus the majority of threats will attempt to gain access through this portal. All sensitive information, such as consumer accounts, passwords, addresses, credit card numbers, and social security numbers should not be stored on the web server (Shwan, 2006). If it is absolutely necessary to do so, the information should be encrypted to the highest standards. Like the client side machine, both physical and logical controls should be put into place to protect the system. Operating system selection, web server software, and their configurations play an important role when setting up a web server.
There are six types of vulnerabilities in any type of website and E-Commerce system (Woody, 2003). The methods used in a system’s design, implementation, and configuration, along with its resources, users, and business processes are each at risk for vulnerabilities (Woody, 2003). In the FBI Computer Crime and Security Survey conducted in 2003, professionals from IT security fields throughout the US where surveyed to which 78% responded that they had detected internet security breaches, while 30% detected breaches from internal sources (Woody, 2003). The most likely sources of attacks were independent hackers with the intention of gaining profit, current and former disgruntled employees, competitive firms, and foreign espionage agencies.
Application Servers and Databases Overview
Application servers further enhance security by handling communication between the web server and the database server. When the web server makes a request for sensitive information from the database, the application server handles the request so a direct link to the database is not permitted, which could create a security risk. E-Commerce databases often house information pertaining to thousands of individuals, thus they are at an elevated risk for intrusion. Methods of disaster recovery must be in place to ensure quick recovery from an attack or vulnerability.
Types of Attacks
One of the most common attacks does not involve knowledge of any type of computer system. Tricking shoppers into revealing sensitive information by posing as a system administrator or customer service representative is known as social engineering. Social engineers use surveillance and a consumer’s limited knowledge of computer systems to their advantage by collecting information that would allow them to access private accounts.
Attackers can use port scanners to ascertain entry points into a system and use various techniques to steal information. This type of software sends signals to a machine or router and records the message the machine responds with to ascertain information and entry points (Cobb, 2007). The main purpose of a port scanner is to gather information related to hardware and software that a system is running so that a plan of attack can be developed.
The connection between a user’s computer and the web server can be “sniffed” to gather an abundance of data concerning a user including credit card information and passwords. A packet sniffer is used to gather data that is passed through a network (Bradley, 2005). It is very difficult to detect packet sniffers because their function is to capture network traffic as they do not manipulate the data stream. The use of a Secure Socket Layer connection is the best way to ensure that attackers utilizing packet sniffers cannot steal sensitive data.
Password cracking can involve different types of vulnerabilities and decrypting techniques; however, the most popular form of password cracking is a brute force attempt. Brute force password attacks are used to crack an individual’s username and password for a specific website by scanning thousands of common terms, words, activities, and names until a combination of them is granted access to a server. Brute force cracking takes advantage of systems that do not require strong passwords, thus users will often use common names and activities making it simple for a password cracker to gain access to a system. Other password cracking methods include using hash tables to decrypt password files that may divulge an entire systems user name and password list.
Trojan software is considered to be the most harmful in terms of E-Commerce security due to its ability to secretly connect and send confidential information. These programs are developed for the specific purpose of communicating without the chance of detection. Trojans can be used to filter data from many different clients, servers, and database systems. Trojans can be installed to monitor emails, instant messages, database communications, and a multitude of other services. The percentage of personal computers with Trojan software installed was a staggering 31% in 2006 with a steady increase from years before (Webroot, 2006).
Denial of Service Attacks
Denial of service attacks are used to overload a server and render it useless. The server is asked repeatedly to perform tasks that require it to use a large amount of resources until it can no longer function properly. The attacker will install virus or Trojan software onto an abundance of user PC’s and instruct them to perform the attack on a specific server. Denial of service attacks can be used by competitors to interrupt the service of another E-Commerce retailer or by attackers who want to bring down a web server for the purpose of disabling some type of security feature. Once the server is down, they may have access to other functions of a server, such as the database or a user’s system. This allows the attacker the means to install software or disable other security features.
Server bugs are often found and patched in a timely fashion that does not allow an attacker to utilize the threat against an E-Commerce web site. However, system administrators are often slow to implement the newest updates, thus allowing an attacker sufficient time to generate a threat. With the millions of web servers in use around the world, thousands often go without timely patches, leaving them vulnerable to an onslaught of server bugs and threats (Khusial, McKegney, 2005).
Super User Exploits
Super user exploits allow attackers to gain control of a system as if they were an administrator. They often use scripts to manipulate a database or a buffer overflow attack that cripples a system, much like a Denial of Service attack for the purpose of gaining control of the system. Users can create scripts that manipulate a browser into funneling information from sources, such as databases.
Web Development Best Practices
There are specific practices that web developers and E-Commerce administrators can utilize on their sites to minimize security threats and improve customer satisfaction. Customer passwords should never be stored directly on the web server in either plain text or encrypted form. A more appropriate method is to use a one-way hashing algorithm to ensure that passwords are not able to be gathered (Khusial, McKegney, 2005). Benefits can also be gathered from the employment of ethical hackers to analyze and report system vulnerabilities. Using previously identified password standards, such as the Federal Information Processing Standards, web developers can ensure that password cracking attempts will be futile. It is imperative that systems be patched within a reasonable amount of time and that systems administrators are up to date on the newest developments in internet security.
Web developers and security professionals must implement and utilize effective security techniques and policies. Technology management must follow the three R’s of security – recognize, resist, and recover (Woody, 2003). Sound security practices include the use of firewalls, threat detection, encryptions, authentication methods, software updates, and penetration testing.
A firewall’s primary use is to filter out communications that may be threatening to a system. It limits traffic to a system and only allows pre-determined activity to pass through its filter. Firewalls can also be configured so that connections are only authenticated if they are from a specific source machine.
Secure Socket Layer (SSL)
Secure Socket Layer is a form of encryption between a client and a host (shopper and web server). All communications when visiting a page with confidential information, such as social security numbers and credit cards, are encrypted before they are sent over the internet. Even if a hacker is able to intercept data packets from the information being exchanged, the hacker would require tools that could decrypt the files. Secure Socket Layer encryption gives individuals browsing a website more confidence that their purchase will be secure, leading to more sales and revenue (Papa, 2001).This makes having a Secure Socket Layer essential for all E-Commerce websites. It is the de facto standard in internet and E-Commerce security. An SSL certificate resides on a secure server to encrypt data and authenticate a website. It also contains data that identifies the certificate owner and the domain that it is registered to. The Secure Socket Layer plays no role in ensuring that data is not intercepted by a hacker; it only ensures that the information will be useless to them.
One-Way Hashing Algorithms
Secure one-way hash functions use a fingerprint on each data packet so that both a web server and client can verify data integrity. One-Way hash functions serve many purposes, such as encryption, integrity checking, and authentication. MD5 is an example of a one-way hash algorithm that can be used to ensure files downloaded from the internet have not been infected with malicious code (Spitzer, 2001). System administrators often use a MD5 algorithm to deliver large files or when downloading updates for systems to ensure the integrity of the data so that they do not install software that may have Trojans or other harmful code.
Transport Layer Security
The purpose of Transport Layer Security, much like Secure Socket Layer, is to ensure attackers cannot access confidential information. TLS ensures that no eavesdropping, tampering, or message forgery is possible (Diaz et al., 2001).
Database Encryption Techniques
The majority of security implementations target the outside defenses of a system. They attempt to isolate the server and not allow incoming transmissions. This is effective against outside intruders, however, often times administrators forget the many attacks originate from inside of an enterprise or E-Commerce department. The database is where the majority of important enterprise files reside, thus it is imperative that they be kept safe. Secure encryption techniques must be put into place that also protect the security keys and allow access only to specific individuals. Thus, it is important to also consider things such as access management, event logging, and auditing (RSA Security, 2006). Encryption strategies must be put into place so that it is not possible for disgruntled employees to gain access to system keys. There are two main methods of database encryption. The first encrypts the files inside of the database, which does not affect outside applications; however, it requires intensive processing and risks the data being stolen outside of the database. Another solution is to encrypt the data when it exits the database. This is considered to be a more secure solution because keys are not stored along with the text, but instead on a piece of hardware
It is imperative that E-Commerce firms create a risk-aware culture that instructs workers of security threats and best security practices. The need for user training is essential as often times individuals have no clue that their actions pose major security threats to their website. Actions, such as users who use unencrypted communication methods for transmitting confidential data, may not understand that they can cripple an enterprise. It does not matter how secure a system is if the individuals who are using it are not educated and understand what to do in security situations.
Effective Password Policies
The implementation of password policies that help to diminish a password crackers’ effectiveness is essential. Accounts should be locked out after a certain number of consecutive wrong username and password combinations. This ensures that users utilizing a brute force attack will not be able to consecutively attempt login combinations. Their IP address will be blacklisted on the web server. Minimum password lengths and maximum occurrences of a specific character are two of many ways to increase E-Commerce security (Khusial, McKegney, 2005).
There is no end to the need to secure data on an E-Commerce system. The threats that these systems face on a daily basis is staggering and the number of different types of threats and manipulation tactics used by hackers ensures that E-Commerce systems must be monitored and updated constantly with new technologies, encryption methods, employer education, and best practices. Based on my research, I have recommendations for E-Commerce firms who require that a security project be undertaken to ensure data security. First, a team must be organized that is comprised of system users, managers, and designers to ensure that guidelines are created that help the project get organized. The security team will ensure that the project remains on target and proper decisions are made. Next, requirements must be defined so that there is firm understanding of the purpose of the security solution. For an E-Commerce store, data security related to consumer information would most likely be at the forefront of the discussions and requirements. A solution for the requirements must be found that is flexible and ensures scalability for future applications.
Through my research, I have isolated key areas that must be concentrated on when choosing the correct type of data security model. These key areas include data that is in motion, which movies through networks and over the internet. Also, data at rest must be examined, which is stored on servers, PC’s, and other storage devices. Access controls must also be put into place that ensure individuals are authorized to view and transfer data. Finally, data integrity must be assured through the protection of security keys that can authorize access to an encrypted server or piece of data.
When searching for a security solution, there are recommendations I have gathered based on my research. It is essential that the solution provide easy integration into an existing system, thus it must allow for efficient bandwidth use and the ability for administrators to use without altering the current operations. This ensures a low total cost of ownership and provides flexibility so that it can be integrated with other software that might improve administrative performance. Security systems should have extensive customization features and the highest levels of security that meet governmental regulations. It must also allow for logging and the following of an audit trail. All solutions should be created using standard based systems to ensure that they can be utilized with software from other leading security firms. Solutions should ensure that data integrity be placed at the forefront of operations by only storing access keys in hardware.
Ensuring that E-Commerce firms follow these security methods will keep prying eyes from reaching a consumers sensitive information and keep the E-Commerce firm from losing or compromising important business practices. It is important for individuals to understand that the internet is ever-changing and new research and methods of compromising data are discovered every day that could potentially allow access to private data. With the use of best website practices and strong security techniques there is a very small chance that an educated end user will be affected. The majority of individuals affected on a daily basis are those who have no knowledge related to information security, thus they are left exposed to the multitude of threats waiting specifically for users such as themselves on the internet. As the research and comments have shown, E-Commerce is not secure and everyday there are security breaches around the world where information is stolen. It is important for individuals to understand that while this does in fact happen, E-Commerce is still more secure than commerce in the real-world. When at a restaurant and someone leaves their card on the table, or when ordering from a catalog, there are inherent risks involved that may allow any individual to copy the credit card information and use it at a later time. In contrast, when you order online, that information is transmitted over a secure connection that only a determined and well-trained individual can gain access to; as long as the user takes proper security precautions. It is important to understand for users of E-Commerce systems that a system that has been configured properly is almost impossible to gain access to.
A firm understanding of E-Commerce security features, methods, and threats allows both users and security administrators to trust the system that they are working with. If proper techniques are used to secure and use a system, it is almost impossible for an unauthorized user to gain access. On the other hand, the multitude of hacking and cracking applications available pose a serious threat to E-Commerce applications and it is important to understand their uses and the threats that they pose. Just as important, especially for administrators, is to understand and gather information on a daily basis related to the newest research regarding security. Because the internet is ever-changing, it is essential that individuals stay up to date on the newest occurrences that might affect the systems that they are using and divulging their confidential information to.
Convincing E-Commerce firms to take the important step of ensuring data security is essential for systems administrators. These individuals must present to managers the data that shows the high rate of data theft and the whirlwind of problems it leaves behind for firms and consumers. The reiteration of the importance of user training cannot be said enough. A system is only as secure as the individuals who are accessing it. The highest encryption standards will not hold up if an individual is allowed access to the key that ensures its security, thus user education must take place to diminish the ability of individuals to access such files and documents.