WIXLIB

Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:407Network Security: A Beginner’s GuideBased on this scenario, we can examine the security requirements for each of the basesecurity services: Confidentiality All of the information provided to the customers is confidentialand must be protected in transmission as well as after the customer gets the information.Payment is normally made through another mechanism (for the subscription service), sono credit card information must be handled by the e-commerce service. Integrity The customer will want to have integrity of the information provided, so there mustbe some assurance that information in the organization’s database has not be tampered with. Accountability Since the customers purchase subscriptions to the information, theorganization will need to have some form of identification and authentication so that onlysubscribers can view the information. If some customers are billed by their usage of thesystem, an audit trail must be kept so that billing information can be captured.Distribution of InformationAs a last example, let’s take a manufacturing organization that uses distributors to sell itsgoods. Each distributor requires pricing information as well as technical specifications oncurrent models. The pricing information may be different for each distributor, and themanufacturer considers the pricing information to be confidential. Distributors can also makeorders for goods through the service and report defects or problems with products. Distributorscan also check to see the status of orders previously made.Based on this scenario, we can examine the security requirements for each of the basesecurity services:CRITICAL SKILL17.2 Confidentiality Price sheets, orders, and defect reports are confidential. In addition,each distributor must be limited in which price sheets and orders can be seen. Integrity The price sheets must be protected from unauthorized modification. Eachorder must be correct all through the system. Accountability The manufacturer will need to know which distributor is requesting aprice sheet or making an order so that the correct information may be provided.Understand the Importance of AvailabilityI am breaking out availability as a separate issue because it is the key issue for e-commerceservices. If the site is not available, there will be no business. The issue goes deeper than this as wellbecause the availability of the site impacts directly on the confidence a customer will have in usingthe service. Now this is not to say that failures in other security services will not impact customerconfidence (you can just see recent failures in confidentiality to see the impact they have), but afailure in availability is almost guaranteed to push a potential customer to a competitor.P:\010Comp\Begin8\957-8\ch17.vpFriday, May 09, 2003 9:24:52 AM40717E-Commerce Security NeedsColor profile: Generic CMYK printer profileComposite Default screen

Color profile: Generic CMYK printer profileComposite Default screen408Module 17:Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:408E-Commerce Security NeedsBusiness-to-Consumer IssuesWe start our examination of availability with the issues associated with an organization thatwants to do business with the general public or consumers. There are several issues surroundingavailability. First, when does the consumer want to use the service? The answer is, wheneverthey want to use it. It does not matter when the organization thinks they will have customers, itonly matters when the customers want to visit the site and do business. This means the site mustbe up all the time.Also keep in mind that this means the entire site must be up all the time. Not only must theWeb site be up, but also the payment processing and any other part of the site that a customer maywant to use. Just think how a potential customer might feel if they find the site and identify the itemthey want to purchase only to find that the order cannot be processed because the payment system isnot available. That customer is likely to go somewhere else.While it is not a security issue, the whole problem of availability includes business issuessuch as the ability of the organization to fulfill the orders that are entered into the system. Whenbuilding the site, the infrastructure should be sized for the expected load. There is a televisioncommercial that illustrates this point very well. The commercial starts with a team of people whohave just completed an e-commerce site. They are watching a screen and waiting for the firstorder. It appears, and everyone breathes a sigh of relief. Then more orders come and more andmore until the scene closes with several hundred thousand orders. It is obvious from the reactionsof the team that they were not expecting this and they may not be able to handle it. Such issueshit online retailers over the 1999 Christmas season. Several large retailers had trouble handlingthe number of orders and almost went out of business because of it.Business-to-Business IssuesBusiness-to-business e-commerce is very different than business-to-consumer. Business-tobusiness e-commerce is normally established between two organizations that have some typeof relationship. One organization is normally purchasing products or services from the other.Since the two organizations have a relationship, security issues can be handled out of band(meaning that the two organizations do not have to negotiate the security issues whileperforming the transaction).Availability issues may be more stringent, on the other hand. Organizations set up this typeof e-commerce to speed up the ordering process and to reduce overall costs in processing paperpurchase orders and invoices. Therefore, when one organization needs to make an order, the otherorganization must be able to receive and process it. Some business-to-business relationships willset particular times of day when transactions will take place. Others may have transactions thatoccur at any time.As an example of this type of e-commerce, take an equipment manufacturer. This manufactureruses large amounts of steel in its products and has decided to create a relationship with a local steelprovider. In order to reduce inventory costs, the manufacturer wants to order steel twice a day andP:\010Comp\Begin8\957-8\ch17.vpFriday, May 09, 2003 9:24:52 AM

Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:409Network Security: A Beginner’s Guidehave the steel delivered 24 hours after ordering for immediate use in its products. The relationshipbetween the manufacturer and the steel mill is established so that the manufacturer will order eachmorning and each afternoon. That means that the steel mill’s e-commerce site must be up andworking properly at these times. If it is not, the manufacturer will not be able to order steel and mayrun out before the steel it needs is delivered. The supplier may not be able to dictate when thesystem must be available.NOTEObviously, there is an alternative if the site is down. The manufacturer could order thesteel by making a phone call. Or the steel mill might see the site is down and call themanufacturer to get the order. In any case, other systems have to be employed todetermine that something is not working and to use an alternative approach.Global TimeE-commerce availability is governed by the concept of global time. This concept identifies theglobal nature of the Internet and of e-commerce. Traditional commerce depends upon people.People must open a store and wait for customers. The store is open during the hours that thecustomers are likely to be awake and shopping.When mail order shopping was created, we began to see the concept of global time appear.Customers may choose to order products over the phone at times when they will not go out toa store. This caused mail order organizations to have employees manning the phones over agreater time period. Some mail order organizations can accept orders 24 hours a day.The Internet is the same way. It exists all over the world. Therefore, no matter what time itis, it is daylight somewhere. Some organizations may target their products to a local audience.But just because the product is targeted at a local audience does not mean that only a localaudience will be interested. Orders may come from places that were not anticipated. In order toexpand the market for the organization’s products, the e-commerce site must be able to handleorders from unexpected locations.Client ComfortIn the end, availability addresses client comfort. How comfortable is the client with the ability ofthe organization to process the order and deliver the goods? If the site is unavailable when thecustomer wants to order goods, the customer is unlikely to feel comfortable with the organization.The same is true if the customer wants to check the status of an order or to track a purchase.If the capability is advertised and is not available or does not work as advertised, the customerwill lose confidence and comfort. I had this happen to me a few years ago. I ordered a softwarepackage from an online retailer. The retailer had the best price and was a well-known name.When the package did not arrive as expected, I tried to track the package via the e-commerce site.P:\010Comp\Begin8\957-8\ch17.vpMonday, May 12, 2003 12:12:58 PM40917E-Commerce Security NeedsColor profile: Generic CMYK printer profileComposite Default screen

Color profile: Generic CMYK printer profileComposite Default screen410Module 17:Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:410E-Commerce Security NeedsThe site advertised a way to track orders, but the function did not work. In the end, the retailerlost future business because they could not provide a simple service like accurately trackingmy order.Customer comfort or discomfort can also multiply quickly. Information is shared over theInternet in many ways, including sites that review companies and products, electronic maillists where people discuss any number of topics, chat rooms that do the same, and news thatprovides a bulletin board type of discussion. Organizations that provide good service areidentified on these sites and lists. People recommend these organizations to their friends andacquaintances. Organizations that do not provide good service are just as quickly identified sothat the cost of failing with one customer can be multiplied hundreds if not thousands of timesin minutes.Cost of DowntimeAfter all this talk of the issues surrounding availability, it becomes clear that the cost ofdowntime is high. This cost is incurred regardless of why the e-commerce site is down. Itcould be hardware or software failure, a hacker causing a denial-of-service attack, or simpleequipment maintenance.The cost of downtime can be measured by taking the average number of transactions over aperiod of time and the revenue of the average transaction. However, this may not identify thetotal cost as there may be potential customers who do not even visit the site due to a report froma friend or online acquaintance. For this reason, each e-commerce site should be architected toremove single points of failure. Each e-commerce site should also have procedures for updatinghardware and software that allow the site to continue operation while the systems are updated.Solving the Availability ProblemWe have discussed a lot of availability issues, but how can they be solved? The short answer isthat they can’t. There is no way to completely guarantee the availability of the e-commerce site.That said, there are things that can be done to manage the risk of the site being unavailable.Before any of these management solutions can be implemented, you must decide howmuch the availability of the site is worth. Fail-over and recovery solutions can get expensivevery quickly and the organization needs to understand the cost of the site being unavailablebefore an appropriate solution can be designed and implemented.The way to reduce downtime is redundancy. We start with the communications system. Ifyou look back at Module 16, we talked about several Internet architectures. At the very least,the Internet architecture for an e-commerce site should have two connections to an ISP. Forlarge sites, multiple ISPs and even multiple facilities may be required.Computer systems will house the e-commerce Web server, the application software,and the database server. Each of these systems is a single point of failure. If the availabilityP:\010Comp\Begin8\957-8\ch17.vpMonday, May 12, 2003 12:13:14 PM

Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:411Network Security: A Beginner’s Guideof the site is important, each of these systems should be redundant. For sites that expect largeamounts of traffic, load-balancing application layer switches can be used in front of the Webservers to hide single failures from the customers.When fail-over systems are considered, don’t forget network infrastructure componentssuch as firewalls, routers, and switches. Each of these may provide single points of failure inthe network that can easily bring down a site. These components must also be configured tofail-over if high availability is required.CRITICAL SKILL17.3Implement Client-Side SecurityClient-side security deals with the security from the customer’s desktop system to thee-commerce server. This part of the system includes the customer’s computer and browsersoftware and the communications link to the server (see Figure 17-1).Within this part of the system, we have several issues: The protection of information in transit between the customer’s system and the server The protection of information that is saved to the customer’s system The protection of the fact that a particular customer made a particular orderFigure 17-1 Client-side security componentsP:\010Comp\Begin8\957-8\ch17.vpFriday, May 09, 2003 9:24:53 AM41117E-Commerce Security NeedsColor profile: Generic CMYK printer profileComposite Default screen

Color profile: Generic CMYK printer profileComposite Default screen412Module 17:Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:412E-Commerce Security NeedsCommunications SecurityCommunications security for e-commerce applications covers the security of information thatis sent between the customer’s system and the e-commerce server. This may include sensitiveinformation such as credit card numbers or site passwords. It may also include confidentialinformation that is sent from the server to the customer’s system such as customer files.There is one realistic solution to this: encryption. Most standard Web browsers include theability to encrypt traffic. This is the default solution if HTTPS is used rather than HTTP. WhenHTTPS is used, a Secure Socket Layer (SSL) connection is made between the client and theserver. All traffic over this connection is encrypted.The encryption of HTTPS will protect the information from the time it leaves thecustomer’s computer until the time it reaches the Web server. The use of HTTPS has becomerequired as the public has learned of the dangers of someone gaining access to a credit cardnumber on the Internet. The reality of the situation is that consumers have a liability of at most 50 if their card number is stolen.Saving Information on the Client SystemHTTP and HTTPS are protocols that do not keep state. This means that after a Web page isloaded to the browser, the server does not remember that it just loaded that page to thatbrowser. In order to conduct commerce across the Internet using Web browsers and Webservers, the servers must remember what the consumer is doing (this includes informationAsk the ExpertQ:A:Is there any difference between 40-bit and 128-bit encryption when it comes to usein e-commerce?Module 12 has a more detailed discussion on encryption algorithms and key length.The SSL key can be 40 or 128 bits in length. The length of the key directly affects thetime and effort required to perform a brute-force attack against the encrypted traffic andthus gain access to the information. Given the risks associated with sending sensitiveinformation over the Internet, it is certainly a good idea to use encryption. However,unless the information is extremely important, there is little difference in risk betweenusing the 40-bit or 128-bit version. For an attacker to gain access to the information,she would have to capture all of the traffic in the connection, and use sufficient computingpower to attempt all possible encryption keys in a relatively short period of time (to beuseful, this process cannot take years!). An attacker with the resources to do this willlikely attack a weaker point such as the target’s trash or perhaps the target’s wallet ifthe credit card number is the information that is sought.P:\010Comp\Begin8\957-8\ch17.vpFriday, May 09, 2003 9:24:53 AM

Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17Blind Folio 17:413Network Security: A Beginner’s Guideabout the consumer, what they are ordering, and any passwords the consumer may have usedto access secured pages). One way (and the most common way) that a Web server can do thisis to use cookies.A cookie is a small amount of information that is stored on the client system by the Webserver. Only the Web server that placed the cookie is supposed to retrieve it, and the cookieshould expire after some period of time (usually less than a year). Cookies can be in cleartextor they can be encrypted. They can also be persistent (meaning they remain after the clientcloses the browser) or they can be non-persistent (meaning they are not written to disk butremain in memory while the browser is open).Cookies can be used to track anything for the Web server. One site may use cookies totrack a customer’s order as the customer chooses different items. Another site may use cookiesto track a customer’s authentication information so that the customer does not have to log in toevery page.The risk of using cookies comes from the ability of the customer (or someone elsewith access to the customer’s computer) to see what is in the cookie. If the cookie includespasswords or other authentication information, this may allow an unauthorized individual togain access to a site. Alternatively, if the cookie includes information about a customer’s order(such as quantities and prices), the customer may be able to change the prices on the items.TIPWhen an order is placed, the prices should be checked if stored in a cookie.The risk here can be managed through the use of encrypted and non-persistent cookies. If thecustomer order or authentication information is kept in a non-persistent cookie, it is not written tothe client system disk. An attacker could still gain access to this information by placing a proxysystem between the client and the server and thus capture the cookie information (and modify it).If the cookies are also encrypted, this type of capture is not possible.RepudiationOne other risk associated with the client side of e-commerce is the potential for a clientor customer to repudiate a transaction. Obviously, if the customer truly did not initiate thetransaction, the organization should not allow it. However, how does the organization decidewhether a customer is really who he says he is? The answer is through authentication.The type of authentication that is used to verify the identity of the customer depends onthe risk to the organization of making a mistake. In the case of a credit card purchase, there areestablished procedures for performing a credit card tran

Network Security: A Beginner’s Guide 405 Begin8 / Network Security: A Beginner’s Guide / Maiwald / 222957-8 / 17 Blind Folio 17:405 17 E-Commerce Security Needs manufacturers have printed and sent the information in hard copy through the mail, or they set up elaborate and expensive pri