Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 266 views

    E-Business Security: Abhishek Harbhajanka Kranti Deori Nupur Singh Priyashree Rai Shreya Shrivastava Yachna Rotwal

    Uploaded by

    shreyashri
    This document discusses e-business security. It covers the need for security in e-business to build trust, challenges in securing e-business due to new technical demands, and common security threats. It then outlines approaches to e-business security including using layered security across organizational, application, network, operating system and physical layers. Specific security technologies and an example security breach at IRCTC are also summarized.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd

    E-Business Security: Abhishek Harbhajanka Kranti Deori Nupur Singh Priyashree Rai Shreya Shrivastava Yachna Rotwal

    Uploaded by

    shreyashri
    266 views22 pages
    This document discusses e-business security. It covers the need for security in e-business to build trust, challenges in securing e-business due to new technical demands, and common security threats. It then outlines approaches to e-business security including using layered security across organizational, application, network, operating system and physical layers. Specific security technologies and an example security breach at IRCTC are also summarized.

    Original Title

    Ebiz Finally Final

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses e-business security. It covers the need for security in e-business to build trust, challenges in securing e-business due to new technical demands, and common security threats. It then outlines approaches to e-business security including using layered security across organizational, application, network, operating system and physical layers. Specific security technologies and an example security breach at IRCTC are also summarized.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    266 views22 pages

    E-Business Security: Abhishek Harbhajanka Kranti Deori Nupur Singh Priyashree Rai Shreya Shrivastava Yachna Rotwal

    Uploaded by

    shreyashri
    This document discusses e-business security. It covers the need for security in e-business to build trust, challenges in securing e-business due to new technical demands, and common security threats. It then outlines approaches to e-business security including using layered security across organizational, application, network, operating system and physical layers. Specific security technologies and an example security breach at IRCTC are also summarized.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 22

    E-Business Security

    Presented By:
    Abhishek Harbhajanka
    Kranti Deori
    Nupur Singh
    Priyashree Rai
    Shreya Shrivastava
    Yachna Rotwal
    INTRODUCTION
    • Companies can reach new
    customers with e-commerce
    applications, and then retain them
    with online customer service.
    • Businesses have to provide trust
    and confidence to web interfaces
    • The security technology is vital for
    building trust and confidence in
    electronic relationship
    Technical knowledge - Security

    • Traditional Enterprise Security- did not fit the demands of E-


    business
    • New approach is to provide strategic information to internal
    employees as well as business partners and customers
    • Huge concern for security as it has corporate image as well as legal
    implications
    • Building authorization and authentication functions separately-
    requires software expertise, is time-consuming, and is expensive
    • Due to rapid emergence of e-business the security infrastructure
    technology is still emerging into the market
    • Privacy protection has become a major E-Business concern.
    – an e-commerce site may be personalized to fit each customer’s
    needs, using stored information about the customer
    – Businesses that store this information need to protect it from
    unauthorized use

    • “The goal is to provide access to specific information, but also to


    ensure that only the right level of access is provided to exactly the
    right people.”
    Infrastructure Required( Physical Security)

    Physical security :-

    • Store all your IT equipment in a secure and lockable location.


    • Keep up-to-date logs for all equipments.
    • Appropriate insurance policies and develop emergency repair
    plans
    • Extra measures in place for notebook computers (such as
    encrypting all data stored on them)
    • Make sure all staff are aware of security policies.
    • Report any suspicious activities.
    Personnel security :-
    • Make sure passwords and access systems are revoked
    when staff resigns.
    • Do not give any single member of staff complete
    access to all the data.
    • Keep logs documenting access to key business
    information.
    • Implement and maintain a strong password policy .
    • Conduct regular internal security audits.
    Layered approach to security
    Organisational Security

    Application Security

    Network Security

    Operating System Security

    Physical Security
    Layered approach to security
    Organisational Security

    Application Security
    • Physical access restriction
    • Biometrics
    Network Security

    Operating System Security

    Physical Security
    Layered approach to security
    Organisational Security
    • User login
    • Knowledge of vulnerabilities
    • Data / storage encryption
    Application Security

    Network Security

    Operating System Security

    Physical Security
    Layered approach to security
    Organisational Security

    Application Security
    • Training / education
    Network Security of employees
    • Calamity response team and policy
    • Security policy
    Operating System Security
    • PKI organisation
    • Processes / organisation
    Physical Security
    eBusiness Risk Management
    • Risk Strategy
    • Risk Committees
    • Risk, Incident and Crisis
    Management
    • Risk Management Intranet Portals
    • Enterprise Risk Management

    11
    What Are The Major Types of Internet Fraud?
    • Auction and Retail Schemes Online.
    • Bogus money offers
    • Business Opportunity/"Work-at-Home" Schemes Online. 
    • Identity Theft and Fraud
    • Bad checks for services or goods
    • Charity frauds
    • Investment Schemes Online-Market Manipulation Schemes.
    – “Pump-and-Dump” scheme
    – “Scalping" schemes
    • Credit-Card Schemes. 
    – Phishing
    – Pharming
    – Skimming
    – Dumpster diving
    How to protect yourself
    • GENERAL TIPS ON POSSIBLE INTERNET FRAUD SCHEME.
    – Don't Judge by Initial Appearances.
    – Be Careful About Giving Out Valuable Personal Data Online.
    – Be Especially Careful About Online Communications With Someone
    Who Conceals His True Identity
    – Watch Out for "Advance-Fee" Demands.
    • AUCTION AND RETAIL SALES SCHEMES
    – Research The Prospective Seller Carefully.
    – Pay by Credit Card or Escrow Service If Possible.
    • INVESTMENT SCHEMES ONLINE
    – Take Your Time In Making Investment Decisions.
    – Research The Potential Investment Opportunity - And Who's Behind
    It - Carefully.
    Security technologies

    • What security technologies do you know about that


    attempt to prevent the attacks.
    – Secure sockets layer
    – Firewalls
    – Intrusion detection systems
    – Anti-virus software
    – Managing users, groups, and access permissions
    – Encryption (of files, e-mails)
    E-PAYMENT TRANSACTION CYCLE
    Securing ePayments
    • Identification and authenticate
    – the ability to verify both the transacting parties
    • Authorization
    – the ability to validate the rightful owner to the
    transaction
    • Integrity and confidentiality
    – the ability to transmit the transaction securely
    – the ability to store the transaction properly
    • Accountability
    – The ability to provide audit trail as evidence in dispute
    • Policies for sharing risks and liabilities
    – the mechanism to settle disputes/non-repudiation

    17
    Funds Flow in a Payment Gateway

    How PayPal Works


    Payment for online purchase of goods or services

    Sender Receiver

    Customer clicks If New Customer: Merchant gets Merchant has the


    on PayPal link Customer signs up on electronic notification option to withdraw
    on merchant’s PayPal website and enters of funds received. funds or send
    auction or card/bank information and Merchant delivers payment to another
    website. payment amount. goods or services. customer.
    If Existing Customer:
    Customer logs into PayPal
    website and enters
    payment amount.

    • Funds flow from PayPal account to the receivers bank account.


    • PayPal has a US $ bank account with Deutsche Bank in Singapore
    • PayPal sends payment instructions to DB Singapore along with US$
    • DB converts US$ into INR and disburses payments out of India (out of DB owned bank
    account, PP does not have a bank account in India)
    •
    Case Study - IRCTC
    www.irctc .co. in was the largest growing website in the Asia Pacific
    Region.
    • Most popular service was to book tickets online.
    • For booking one needs to create a login name and booking can be done
    using – debit/credit card using 2 payment gateways
    – ICICI Bank
    – CitiBank
    • Received information that fraudulent credit card transactions were
    being made on the site by various ID’s
    • On analysis, ID’s and the card numbers had 1 thing in common – all
    tickets were collected from the counter
    • The identity documents of the person revealed that he had the old
    address on his PAN Card.
    • The accused was working in the Credit Card Section of a Multi-
    National Bank as Sales Executive
    • Obtained Card information by Social Engineering
    • Purchased tickets for self and family
    Security in M-Banking
    • Main issue
    • Use of smart cards
    • Biometrics security
    • Aspects that need to be addressed:
    – Physical security of the device
    – Security of client application running on the cell phone
    – Authentication of device with the service provider
    – User-ID and password authentication of bank’s customer
    – Data encryption-offline and the one being transmitted
    – Scalability and reliability
    Future of Security
    • Faster and accurate user authentication using biometric
    technology
    • Future lies in human intervention and innovation
    • Adaptive security-built around an API for its real secure
    intrusion detection system
    • Good vendor support
    • State of SSL and SET
    • Stronger encryption
    • More attempts to control physical access by limiting it to
    authorized users
    References
    • http://www.e-
    businessguide.gov.au/protecting/start/sources/physi
    cal
    • http://www.techlivez.com/2007/08/new-
    technology-will-use-your-finger-instead-of-credit-
    card-for-payments/
    • http://www.theregister.co.uk/2002/01/28/future_tr
    ends_in_security_3i/
    • http://www.1888articles.com/the-future-of-internet-
    security-05sab855.html
    • http://www.ecommercetimes.com/story/32373.html

    You might also like