E-BUSINESS

PROJECT REPORT ON

SECRUITY BREACH and WAYS to COMBAT SECRUITY ISSUES

DEPARTMENT OF COMMERCE, MANIPAL-576104.

BY: SUNNY KUMAR 092601039

SECURITY BREACH INRTODUCTION

Security is one of the most important issues affecting e-business.
A situation where an individual intentionally exceeds or misuses network, system, or data access in a manner that negatively affects the security of the organizations data, systems, or operations.

Secure transactions are of high value to customers. Security also underpins confidence in ebusiness and e-commerce and helps e-businesses to achieve growth. However, online transactions are inherently insecure. There is a paradox in the new economy created by the internet. Firms engaging in e-business need to be both open and closed. That is, they need to be open to sharing information with customers, suppliers, distributors, etc., but closed to hackers and other unwanted intruders. There is a balance to be struck between securing information and allowing access to those who need it to undertake transactions. There are a number of ways internet security can be breached. Other security breaches include unauthorised network entry, denial of service, data loss, information loss, manipulation of software applications or systems programs, fraud, trafficking in illegal materials, theft and piracy. Malicious code is a particularly prevalent and damaging form of security breach. This is software designed to damage, destroy, or deny service to the target system. Examples of malicious code include: y y y y y y y y Virus: a virus attaches itself to another program and is activated to cause damage when the host program is opened; Trojan horse: hides the true identity of user. The damaging behaviour is revealed when the program is activated; Logic bomb: triggers actions when conditions occur; Time bomb: triggers action when a specific time has elapsed; Trapdoor: an electronic hole in software that is left open by accident or intention; Worm: a virus that replicates on to other machines through a network; Rabbit: replicates itself without limit in order to exhaust a resource; Pharming: duping online bank customers into revealing account details.

Security in e-business and e-commerce typically entails setting in place systems that ensure: y y y y Authenticity; Data integrity; Confidentiality; Availability.

Encryption
Encryption is the most commonly used method of securing transmissions via the internet. There are two main types of encryption secret key and public key. Secret-key encryption is where parties to a transaction share a common encrypted key number that is known only to them. The same key is used to encrypt and decrypt a message. Public-key encryption is where the encrypted key number used is different for sender and receiver. This method, sometimes known as a symmetric cryptography, uses two keys one to encrypt the message and the other to decrypt the message. The keys are related by numerical code and the material only becomes readable when the keys are used in combination. Each user has a public key and a private key. No key pair can be transformed into the other. This means that any user remains free to publish their own public key and allow others to communicate with them using that public key to encrypt the message. This security is maintained so long as the user ensures that the private key is not disclosed to anyone else.

Secure Electronic Transactions (SET)

One of the biggest impediments to growth in e-business and e-commerce is the customers fear that their credit card information may be intercepted by a third party. This issue has been recognised as a threat to e-business for some time. In 1996 Visa and Mastercard jointly developed the Secure Electronic Transaction (SET) protocol. The SET protocol uses cryptography to provide confidentiality of information, ensure payment integrity, and confirm the authenticity of cardholder and seller. Both buyer and seller in a transaction receive a digital certificate (or key) from a trusted certification authority (CA).

Public key infrastructure

Rather than having competition in the provision of secure systems, there is a compelling argument for having a single standard protocol. The Public Key Infrastructure (PKI) is one initiative that is designed to provide a generic solution to the issue of security. PKI is an e-commerce architecture that combines specialist authorities, digital certificate management systems, and directory facilities to create secure networks on top of unsecured networks such as the internet (May, 2000). PKI is managed by certificate authorities, such as the Post Office or BT in the United Kingdom. The certificate authority records all users of public keys in the form of a digital certificate and oversees all operational aspects of data encryption. Qualifying users of public keys must gain approval from Registration Authorities. The public-key encryption provides confidentiality; digital certificates ensure authenticity of identity; and the PKI management systems ensure nonrepudiation such that transactions cannot be denied by either buyer or seller.

Other forms of security breach Hacking

Computer hacking is where someone deliberately and illegally gains access to a system. Much hacking activity is for criminal gain. That is, hackers seek to gain valuable information, such as credit card details, in order to commit fraud. Others use the information they have gained illegally to deliberately undermine organisations or to disrupt the free flow of goods and services in the market. The type of hacking activity can be identified as: y y y y Monitoring of information Accessing database Identity fraud Denial of service

Hacking has become an increasing problem as technology has advanced. In particular, wireless computers, known as wi-fi, are vulnerable to security breaches. Wi-fi technology allows communication between computers by transmitting data across radio waves rather than through cables.

Spam
Spam is unsolicited e-mails that are sent to random and untargeted addresses. Sometimes referred to as junk e-mail, spam has become a significant problem for organisations and individuals to deal with. Firewalls can provide some security against unsolicited e-mails and illegal access and can provide protection of information. The motivation for sending spam emails is multifarious and may include initiating a form of direct advertising; a method of spreading viruses; a method of inserting cookies as a means of gathering valuable information that can then be sold on to third parties; a malicious attack on particular organisations or individuals; or as a means of making a political gesture.

Fraud
Fraud represents one of the biggest barriers to the growth of the internet for business and commerce. The true scale of fraudulent activity on the internet may never be known since many victims prefer not to report the crime and firms opt to avoid negative publicity. The practice of so-called phishing is another growing problem for e-businesses and consumers. This involves fraudsters creating an identical website to target companies with the aim of duping consumers into revealing personal financial information. Banks and financial institutions have been particularly targeted and the publicity surrounding the fraud has restricted the growth of online banking.

Misrepresentation of identity
Firms can install sophisticated software to check the authenticity of identity of those they deal with. Nevertheless, it is necessary for firms to maintain vigilance to ensure that security

breaches do not occur that undermine their credibility. The internet provides easy access to a wealth of information on a huge array of subjects. However, not all the information posted on the internet is genuine. It is necessary for firms to ensure that the information they use is accurate and genuine. Failure to do this can lead to embarrassment, diminished reputation, legal proceeding or financial loss.

WAYS TO COMBAT SECURITY ISSUES

1: Change default passwords Its surprising how many devices and applications are protected by default usernames and passwords. Attackers are also well aware of this phenomenon. Not convinced? Run a Web search for default passwords, and you will see why they need to be changed. Using good password policy is the best way to go; but any character string other than the default offering is a huge step in the right direction.

2: Dont reuse passwords On more than one occasion, Ive run into situations where the same username/password combination was used over and over. I realize its easier. But if I know this, Im pretty sure the bad guys do as well. If they get their hands on a username/password combination, theyre going to try it elsewhere. Dont make it that easy for them.

3: Disable user accounts when an employee leaves Security breaches are easier to pull off when the attacker has insider information. That makes it essential to disable all IT accounts of a user who has terminated employment. It doesnt matter whether the employee is leaving under amicable terms or not.

4: Examine security logs Good administrators know about baselining and try to review system logs on a daily basis. Since this article deals with security breaches, Id like to place special emphasis on security logs, as theyre the first line of defense.

5: Do regular network scans

Comparing regular network scans to an operational baseline inventory is invaluable. It allows the administrator to know at a glance if and when any rogue equipment has been installed on the network. One method of scanning the network is to use the built-in Microsoft command net view. Another option, and the one I prefer, is to use freeware programs like NetView. Theyre typically in a GUI format and tend to be more informative.

6: Monitor outbound network traffic Malware is becoming sophisticated enough to avoid detection. One method of exposing it is monitoring outbound network traffic. Suspicions should be raised when the number of outbound connections or the amount of traffic deviates from normal baseline operation. To tell the truth, it may be the only indication that sensitive information is being stolen or that an email engine is actively spamming. 7: Patch and update regularly Keeping operating system and application software up to date is the best way to foil breach attempts originating from outside the networks perimeter (Internet). Its that simple. If the operating system and applications arent vulnerable, the exploit will not work.

8: Implement a security plan No matter what size the organization, having a security plan in place is invaluable for the following reasons: Everyone is working off of the same playbook, which provides continuity. When the organization is in panic mode, the security plan will provide solid solutions developed at a time when everyone was less anxious.

9: Raise user awareness about information security Some of the clients are bullish on user training and others arent. The difference is night and day, with the proof being evident in my billable hours. The Web is littered with papers that explain the benefits of user training, but theyre typically geared toward increasing user efficiency in the work environment.

10: Get upper management to buy in Getting upper management buy-in for security policies and for purchasing the required technology is typically a tough sell. Another problem is when people in upper management give the go-ahead to implement security practices but feel the rules dont apply to them.

CONCLUSION
The development of the internet and the World Wide Web has led to a huge growth in online transactions for products and services. The existing legal framework of individual countries and trading pacts, such as the EU, have had to be updated to take account of this particular method of transacting. The EU has been active in setting directives on internet-related issues such as transactions and security. An important cornerstone of the legal framework protecting firms engaged in e-business or ecommerce is intellectual property rights. The legislation protects the investment in time, money and creative input that developers expend on the production of a product or service. Patents can be registered to protect unique innovations and trademarks protect brand names. Copyright law offers protection for literary, musical and artistic works. Consumers are offered a measure of protection through data protection legislation that ensures access to information held by organisations. The European Union has issued a directive relating to data protection that all member states must adhere to. The directive also covers issues of privacy. The ecommerce industry has also been active in trying to boost consumers confidence by setting up privacy seals that formalise codes of conduct for organisations in matters of privacy. This is one method of trying to bolster trust in online relationships. A great deal of e-business and e-commerce activity is based on trust between the parties to a transaction. Technology such as encryption, public keys and secure electronic transactions (SET) offers a measure of security but there needs to be an ongoing level of trust to maintain the growth in e-business and e-commerce.