E-Commerce Security and Fraud Issues and Protections

Abstract

The State University of New York (SUNY) College at Old Westbury ( oldwestbury.edu ) is a relatively small U.S. university located in Long Island, New York. The college has 3,300 students and 122 full-time faculty. Internet access is essential for both faculty and students.

Glossary

Access control 

A defense mechanism that determines who (person, program, or machine) can legitimately use the organization’s computing resources (which resources, when, and how).

Application controls 

Controls that guard applications.

Authentication 

A process to verify (assure) the real identity of an EC entity, which could be an individual, software agent, computer program, or EC website.

Authorization 

The provision of permission to an authenticated person to access systems and perform certain operations in those specific systems.

Availability 

The assurance that access to any relevant data, information websites, or other EC services and their use is available in real time, whenever and wherever needed.

Banking Trojan 

Malicious software programmed to create damage when users visit certain online banking or e-commerce sites.

Biometric authentication 

A technology that measures and analyzes the identity of people based on measurable biological or behavioral characteristics or physiological signals.

Biometric systems 

A system that can identify a previously registered person by searching through a database for a possible match based on the person’s observed physical, biological, or behavioral traits, or the system can verify a person’s identity by matching an individual’s measured biometric traits against a previously stored version.

Botnet 

Malicious software that criminals distribute, usually to infect a large number of computers.

Business continuity plan 

A plan that keeps the business running after a disaster occurs. Each function in the business should have a valid recovery capability plan.

Business impact analysis (BIA) 

An analysis of the impact of losing the functionality of an EC activity (e.g., e-procurement, e-ordering) to an organization.

Certificate authorities (CAs) 

Independent agencies that issue digital certificates or SSL certificates, which are electronic files that uniquely identify individuals and websites and enable encrypted communication.

CIA security triad (CIA triad) 

A point of reference used to identify problem areas and evaluate the information security of an organization that includes confidentiality, integrity, and availability.

Ciphertext 

An encrypted plaintext.

Controlling the assault of non-solicited pornography and marketing (CAN-SPAM) act 

Law that makes it a crime to send commercial e-mail messages with spam.

Cracker 

A malicious hacker who may be more damaging than a hacker.

Confidentiality 

The assurance of data secrecy and privacy. Namely, the data is disclosed only to authorized people.

Cybercrime 

Intentional crimes carried out on the Internet.

Cybercriminal 

A person who intentionally carries out crimes over the Internet.

Data breach 

A security incident in which data are obtained illegally and then published or processed.

Denial-of-service (DoS) attack 

“A malicious attempt to make a server or network resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet.” (Incapsula, Inc.)

Detection measures 

Methods that help find security breaches in computer systems. Usually this means to find out whether intruders are attempting (or have attempted) to break into the EC system, whether they were successful, whether they are still damaging the system, and what damage they may have done.

Deterrent methods 

Countermeasures that make criminals abandon their idea of attacking a specific system (e.g., a possible deterrent is a realistic expectation of being caught and punished).

Digital envelop 

The pair of encryptions that occurs the sender encrypts with the recipients’ public key, both the original message and the digital signature.

Digital signatures 

The electronic equivalent of personal signatures on paper. They are difficult to forge since they authenticate the identity of the sender that uses the public key.

EC security strategy 

Multiple layers of defense that includes several methods. This defense aims to deter, prevent, and detect unauthorized entry into an organization’s computer and information systems.

E-mail spam 

Occurs when almost identical messages are e-mailed to many recipients (sometimes millions of unsolicited e-mails).

Encryption 

The process of encoding data into a form (called a ciphertext) that will be difficult, expensive, or time-consuming for an unauthorized person to understand.

Encryption algorithm 

The set of procedures or mathematical algorithms used to encrypt or decrypt a message.

Exposure 

The estimated cost, loss, or damage that can result if a threat exploits a vulnerability.

Firewalls 

Barriers between an internal trusted network (or a PC) and the untrustworthy Internet. Technically, it is composed of hardware and a software package that separates a private computer network (e.g., your LAN) from a public network (the Internet).

Fraud 

Any business activity that uses deceitful practices or devices to deprive another of property or other rights.

General controls 

Controls designed to protect all system applications.

Hacker 

Someone who gains unauthorized access to a computer system.

Hash function 

A secured mathematical algorithm applied to a message.

Honeynet 

A network of honeypots designed to attract hackers, just as bees are attracted to honey.

Honeypot 

Simulated information system components such as EC servers, payments gates, routers, database servers, and even firewalls that look like real working systems.

Identity theft 

Wrongfully obtaining and using the identity of another person in some way to commit crimes that involve fraud or deception (e.g., for economic gain).

Information assurance (IA) 

The performance of activities (steps) to protect information systems and their processes against all risks. The assurance includes all tools and defense methods.

Information security 

Measures taken to protect information systems and their processes against all risks.

Integrity 

The assurance that data are accurate and that they cannot be altered.

Internet underground economy 

E-markets for stolen information made up of thousands of websites that sell credit card numbers, social security numbers, e-mail addresses, bank account numbers, social network IDs, passwords, and much more.

Intrusion detection system (IDS) 

A device composed of software and/or hardware designed to monitor the activities of computer networks and computer systems in order to detect and define unauthorized and malicious attempts to access, manipulate, and/or disable these networks and systems.

Key (key value) 

The secret piece used with the algorithm to encrypt (or decrypt) the message.

Key space 

The total universe of possible key values that can be created by a specific encryption algorithm.

Keystroke logging (keylogging) 

The process of using a device or software program that tracks and records the activity of a user in real time (without the user’s knowledge or consent) by the keyboard keys they press.

Macro virus (macro worm) 

A malware code that is attached to a data file rather than to an executable program (e.g., a Word file).

Malware (malicious software) 

A generic term for malicious software.

Message digest 

The results of the hash function that is a special summary of the message converted into a string of digits.

Nonrepudiation 

The assurance that online customers or trading partners cannot falsely deny (repudiate) their purchase, transaction, sale, or other obligation.

Packet 

Segment of the data and information exchanged between computers over the Internet.

Page hijacking 

Illegally copying website content so that a user is misdirected to a different website.

Penetration test (pen test) 

A method of assessing the vulnerability of a computer system, which is done by allowing experts to act as malicious attackers.

Personal firewall 

A firewall that protects desktop systems by monitoring all incoming traffic to your computer.

Pharming 

A scam where malicious code is installed on a computer and used to redirect victims to a bogus websites without their knowledge or consent.

Phishing 

A fraudulent process of attempting to acquire sensitive information by masquerading as a trustworthy entity.

Plaintext 

A human-readable text or message.

Prevention measures 

Ways to help stop unauthorized people from accessing the EC system (e.g., by using authentication devices and firewalls or by using intrusion prevention which is, according to TechTarget “a preemptive approach to network security used to identify potential threats and respond to them swiftly”).

Private key 

A key that only its owner knows.

Protocol tunneling 

Method used to ensure confidentiality and integrity of data transmitted over the Internet by encrypting data packets, and then encapsulating them in packets that can be transmitted across the Internet.

Public key 

A key that is known to all.

Public (asymmetric) key encryption 

An encryption method that uses two keys: public key and private key.

Public key infrastructure (PKI) 

A comprehensive framework for securing data flow and information exchange that overcomes some of the shortcomings of the one-key system.

Risk 

The probability that a vulnerability will be known and used.

Search engine spam 

The technology that enables the creation of spam sites.

Social engineering 

A type of nontechnical attack that uses some ruse to trick users into revealing information or performing an action that compromises a computer or network.

Spam 

The electronic equivalent of junk mail.

Spam site 

Pages that trick search engines into offering biased search results such so that the ranking of certain pages is inflated.

Splog 

Blogs created by spammers solely for advertising.

Spyware 

Tracking software that is installed by criminals or advertisers, without the user’s consent, in order to gather information about the user and direct it to advertisers or other third parties.

Standard of due care 

The minimum and customary practice that a company is reasonably expected to take to protect the company and its resources from possible risks.

Symmetric (private) key encryption 

A scheme in which the same key is used to encrypt and decrypt the plaintext.

Trojan horse 

A program that seems to be harmless or even looks useful but actually contains a hidden malicious code.

Virtual private network (VPN) 

A network that uses the Internet to transfer information in a secure manner.

Virus 

Programmed software inserted by criminals into a computer to damage the system; running the infected host program activates the virus.

Vulnerability 

Weakness in software or other mechanism that threatens the confidentiality, integrity, or availability of an asset (recall the CIA model). It can be directly used by a hacker to gain access to a system or network.

Vulnerability assessment 

A process of identifying and evaluating problem areas that are vulnerable to attack on a computerized system.

Worm 

A software code that can replicate itself automatically (as a “standalone” – without any human intervention). Worms use networks to propagate and infect a computer or handheld device and can even spread via instant messages.

Zombies 

Computers infected with malware that are under the control of a spammer, hacker, or other criminal.