Ecommerce Security   «Prev  Next»
Lesson 3Design for security
Objective Describe security measures needed to protect your e-commerce site.

Describe Security Measures needed to protect your ecommerce Website

A successful security system designed for an e-commerce site is a matrix, or a combination of individual methods, techniques, and subsystems. Whenever possible, you want to use as many security principles and techniques as possible to protect each resource.
For instance, a network that relies solely on authentication is not nearly as secure as one that combines authentication, access control, and encryption. Access control occurs if you apply packet filtering to the router. A firewall provides more access control.
In most e-commerce sites, a firewall is designed to provide access control more than anything else. If you supplement this with Secure Socket Layers (SSL) or Secure Electronic Transactions (SETs) at the Web server, you will be using encryption as well as authentication. Finally, an e-commerce site should always install intrusion detection software on mission-critical network segments and hosts.

  1. Authentication: Establishes a person's identity.
  2. Access control: Determines where a person or network host is allowed to enter a system.
  3. Encryption: Encryption is the process of transforming a file using a mathematical function or technique so that the contents of the file are protected from unwanted viewing.
  4. Packet filtering: The use of a type of firewall device that processes network traffic on a packet-by-packet basis. Packet filter devices allow or block packets, and are typically implemented through standard routers.
  5. Firewall: A firewall is a series of applications and hardware that filters and audits outside network traffic as it passes into your network.

Intrusion Detection
The key areas to secure are:
  1. Local resources
  2. Network resources
  3. Server resources
  4. Database and information resources

As shown in the MouseOver below, these key areas have particular risks associated with them.

Ecommerce security resources
  1. Local resources - Protect your employee workstations by enabling password-protected screen savers to prevent snooping. Require that each employee use a virus checker and observe caution when downloading anything from the Internet.
  2. Network resources - Physically secure your routers, switches, and patch panels. Ensure that your DNS servers are free from tampering. If you have WINS or SAMBA servers internal to your e-commerce company, make sure that they are properly configured and secure. These network resources are the primary communication medium for the entire company. If a hacker gains access to or control of these elements, he or she has access to all or most company data.
  3. Database and information resources - A major asset of any company is the information it organizes and disseminates. A hacker's ultimate goal is to discover this information, as well as tamper with the networks and methods that help to create and communicate the information.
  4. Server resources - Your World Wide Web, email, and FTP servers are vulnerable to several types of intrusions. Typically, servers provide storage for the network infrastructure and act as the hub. They also control overall system security. Hackers try to gain access to server resources because they can then access and control other resources.

Protect Key Resources
The key means of achieving security are:
  1. Use cryptographic methods to provide data confidentiality, data integrity, and authentication
  2. Provide access control for all systems, servers, and files
  3. Secure CGI and other executable scripts
  4. Utilize virus scanning software and keep it up to date
  5. Combine security techniques to provide the best possible security. For example, connect the Web server to the database using a different protocol than TCP/IP
  6. Define a system security policy and security administration
  7. Train all users on security policies that apply to their jobs
  8. Build a firewall between your network and the Internet
  9. Monitor and analyze log files

CGI Scripts Web Search Engines

System attributes

The table below summarizes the most important attributes and goals of an effective security system for an e-commerce site.

1) Security Attributes 1 2) Security Attributes 2 3) Security Attributes 3 4) Security Attributes 4 5) Security Attributes 5 Program 1 Program 2 Program 3 Program 4 Program 5
  1. Allows access to only authenticated legitimate users
  2. Specific application should employ an intuitive interface
  3. Allows business to be conducted as needed
  4. Notifies the administrator quickly and in sufficient detail of a breach
  5. Planning includes initial purchase cost as well as costs for upgrades and service

System Attributes
In the next lesson, you will learn more about operating system security.

Resources Security Risks

Click the link below to review resources and security risks.
Resources Security Risks