Unit 06

E-CommerceA/601/7313

LEVEL 3

LO3 - Understand the effects ofe-commerce on society

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Learning Outcome (LO) The learner will:

Pass The assessment criteria are the pass requirements for this unit. The learner can:

Merit For merit the evidence must show that, in addition to the pass criteria, the learner is able to:

Distinction For distinction the evidence must show that, in addition to the pass and merit criteria, the learner is able to:

1 Know the technologies required for an e-commerce system

P1 Describe the technologies required for e-commerce

2 Understand the impact of e-commerce on organisations

P2 Explain the impact of introducing an e-commerce system to an organisation

M1 - Describe how organisations promote their business using e-commerce

3 Understand the effects of e-commerce on society

P3 Explain the potential risks to an organisation of committing to an e-commerce system

M2 - Explain solutions for the potential risks of using e-commerce

4 Be able to plan e-commerce strategies

P4 Review the regulations governing e-commerce

P5 Examine the social implications of e-commerce on society

D1 - Compare the benefits and drawbacks of e-commerce to anOrganisation

P6 Plan an e-commerce strategy

M3 - Provide annotated planning documentation for your e-commerce strategy

D2 - Evaluate youre-commerce strategy

LO3 - Assessment Criteria

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3 - Understand the effects of e-commerce on society Learners need to understand the potential risks for e-

commerce systems, which should be set initially as research activities. Learners could brainstorm risks and then discuss as a group to identify risks that they may not have considered and look at the different aspects and implications of each.

M2 – Understand the solutions for the potential risks of using e-commerce

The learners could then be encouraged in small groups to further research risks allocated to them to see if they can find an example of when the risk has happened or may have been avoided, as well as find a solution or preventative method. The small groups/pairs could then be encouraged to provide feedback to the main group.

Assessment Criteria P1

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3 - The assessment criterion P3 could be evidenced by the use of a report, leaflet or presentation delivered by the learner that could be supported by tutor observation and/or recorded evidence. The learner is required to explain the potential risks to an organisation of committing to an e-commerce system, this could relate to the business mentioned under assessment criterion P2. The learner must consider all risks identified in the teaching content.

M2 - The merit criterion M2 could be evidenced by the learner providing a detailed explanation of the risks identified under assessment criterion P3, and must give examples to support their evidence and where possible relating these to organisations and individuals that have had these issues. Learners are also required to provide at least a range of solutions or preventative methods for each of the risks outlined for assessment criterion P3.

Assessment Criteria P3, M2

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.1 - Potential risks to an organisation - Hacking

Computer hacking is the practice of modifying computer hardware and software to accomplish a goal outside of the creator’s original purpose. People who engage in computer hacking activities are often called hackers. Since the word “hack” has long been used to describe someone who is incompetent at his/her profession, some hackers claim this term is offensive and fails to give appropriate recognition to their skills.

Computer hacking is most common among teenagers and young adults, although there are many older hackers as well. Many hackers are true technology buffs who enjoy learning more about how computers work and consider computer hacking an “art” form. They often enjoy programming and have expert-level skills in one particular program. For these individuals, computer hacking is a real life application of their problem-solving skills. It’s a chance to demonstrate their abilities, not an opportunity to harm others.

Since a large number of hackers are self-taught prodigies, some corporations actually employ computer hackers as part of their technical support staff. These individuals use their skills to find flaws in the company’s security system so that they can be repaired quickly. In many cases, this type of computer hacking helps prevent identity theft and other serious computer-related crimes.

Computer hacking can also lead to other constructive technological developments, since many of the skills developed from hacking apply to more mainstream pursuits. For example, former hackers Dennis Ritchie and Ken Thompson went on to create the UNIX operating system in the 1970s. This system had a huge impact on the development of Linux, a free UNIX-like operating system. Shawn Fanning, the creator of Napster, is another hacker well known for his accomplishments outside of computer hacking.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.1 - Potential risks to an organisation - Hacking Hacking has many negative effects; Personal information may be leaked,

Intellectual Property could be stolen, and lives can be ruined.

There is no effective way to eliminate cracking. Any security measure put out will be circumvented sooner or later (as an example, see the iPhone 3G unlock). So the only way to keep unwanted criminals out is to keep your software up-to-date and protected from the outside world, i.e. firewalls. Cracking isn't always bad. Some people crack software or security in order to learn how to prevent it. There is a difference between good and bad though; White hat hackers vs. Black hat hackers.

Hacking can take many forms and the infiltration level can vary from curiosity to espionage. Levels of hacking are usually only detected after the fact. Setting systems on Subnet masks is useful but not foolproof, firewalls involve degrees of encrypted security from 8bit to 64bit but can still be accessed. We all know the story of the Norad hack from the movie War Games but how close to the truth is hacking. Governments have set up agencies like CIPAV or US-CERT to determine hacking and security threats to governmental systems but businesses are less prepared.

For information look at: http://www.wired.com/threatlevel/2009/04/fbi-spyware-pro/ For a detailed explanation see: http://technet.microsoft.com/hi-in/magazine/2005.01.anatomyofahack(en-us).asp

x

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.1 - Potential risks to an organisation - Hacking

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.1 - Potential risks to an organisation - Hacking

Most networks today are built on what is called the eggshell principle: hard on the outside and soft on the inside. This means that if an attacker can gain a foothold onto the network, the rest of the network protections will usually fall like dominoes.

Once inside, the most difficult part is often to figure out what to attack next and where to go for the really juicy bits of information. It does not have to be this way. With the proper techniques, we as network administrators can achieve two crucial objectives: to make it much more difficult to gain a foothold in the first place and to make it much more difficult to use that foothold to get anywhere else on the network.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Europe has Entered a ‘Cyber Cold War’ (Source: NATO, FBI, McAfee & Serious Organized Crime Agency)

China Most Actively Spying, but with 120 Other Countries ! NATO Said that All 26 of its Member Countries Have Been

Targeted by Cyber-Attacks (e.g.: Estonia) Georgia’s Government Websites Fall Victim to Cyber-

Attacks (DDoS & Defacements) … “Too Sophisticated for Amateurs !”

Tibetan Government Web Site Injected with Malicious Source-Code

Palin’s Yahoo Account Hacked in Less then 45 Minutes Using Password Reset Functionality

Web Defacers Hacked into CERN Website of the LHC (Large Hadron Collider)

UK Minister Confirms Cyber-Terrorists Attempting to Take Out the National Grid (Aug ’08)

P3.1 - Potential risks to an organisation - Viruses

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Viruses have been the bane of IT and companies since networks were introduced into companies for business transactions. Remember that all computer viruses have been created by someone for a purpose, whether it is to annoy, destroy, deliberately bring down a company or website.

computer virus n. A computer program that is designed to replicate itself by copying itself into the other programs stored in a computer. It may be benign or have a negative effect, such as causing a program to operate incorrectly or corrupting a computer's memory.

All viruses are different so they all act in a different way and have a different purpose. On Symantec the threats are defined daily according to the possibility of risk and the exploit a virus takes advantage on in its attack.

http://www.symantec.com/norton/security_response/threatexplorer/index.jsp

P3.1 - Potential risks to an organisation - Viruses

P3.1 - Task 1 – Define and explain the potential risk to an organisation’s e-commerce system from hacking attacks and viruses.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Phishing is an e-mail fraud method in which the perpetrator sends out legitimate-looking emails in an attempt to gather personal and financial information from recipients. Typically, the messages appear to come from well known and trustworthy Web sites. Those frequently spoofed by phishers include PayPal, eBay, MSN, Yahoo, BestBuy, and America Online. A phishing expedition is a speculative venture: the phisher puts the lure hoping to fool at least a few of the prey that encounter the bait. Phishers use a number of different social engineering and e-mail spoofing ploys to try to trick their victims.

In one typical case before the Federal Trade Commission (FTC), a 17-year-old male sent out messages purporting to be from AOL that said there had been a billing problem with recipients' AOL accounts. The e-mail used AOL logos and contained legitimate links. If recipients clicked on the "AOL Billing Center" link, they were taken to a spoofed AOL Web page that asked for personal information, credit card numbers, personal identification numbers (PINs), social security numbers, banking numbers, and passwords. This information was then used for identity theft.

The Trojan infects and then waits for the victim to visit his or her bank Information is gathered by injecting additional fields into the genuine bank web page as it loads in the browser. No fake web sites are used.

The SSL connection between client and bank is valid (padlock is shown and certificate chain is OK) Classical Anti virus software did not detect this threat

P3.2 - Potential risks to an organisation - Phishing

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Identity Theft - In today’s society, people have a more common way to buy and shop using credit cards instead of cash. They purchase goods and services online instead of at a store. Instead of going to the bank people have online bank accounts. We have the convenience and opportunity to purchase goods from around the world, to pay our bills at two o'clock in the morning, or to check our bank statement from home.

Technology has brought about tremendous advances but technology has also advanced the common criminal. This type of criminal steals someone's identity in order to commit fraudulent acts through Phishing, bin rummaging, telephone scams and hacking.

Thieves are on the look out for our personal information so they can obtain credit cards, bank loans, pay bills, take out mobile phones and more by using our identity. Victims of identity theft suffer from damaged credit reports, drained bank accounts and even a criminal record.

Some identity thieves will give your personal information when they are arrested. This causes embarrassment to you as it creates a criminal record. Often victims of identity theft do not find out they have been victimised until they receive their bank statement or credit card statement in the post or when they are turned down for a loan or flat rental.

Click here for examplesP3.2 - Task 2 – Define and explain the potential risk to an organisation’s e-commerce system from Fraud and Phishing scams and ID Theft.

P3.2 - Potential risks to an organisation – ID Theft

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Over half of UK internet users have admitted using other people's Wi-Fi networks to piggyback onto the internet. It is estimated that 54 per cent of respondents had used someone else's wireless internet access without permission. Even Google.

Many internet-enabled homes fail properly to secure their wireless connection with passwords and encryption, allowing passers-by and neighbours to 'steal' their internet access. Although most businesses have security measures in place to protect their Wi-Fi networks, the protections a lot of companies take is too light to stop a determined piggy-backer.

Piggy backing occurs when a user with a laptop or Wi-Fi connection connects to an unprotected network server. Routers can be protected by a WEP key or WPA protection through 16 or 32 bit encryption and network protocols. But a lot of modems made by the same company have the same initial password to connect to the routers administrative functions or have no WEP or WPA protection set, allowing a user to connect and download without restrictions in the same way a user could user an unprotected Wi-Fi hotspot.

The worst case scenario is an external user connecting not just to the internet through the Wi-Fi but to the network, allowing a user access and control over stored files leading to deletion, corruption and industrial espionage.

P3.3 - Potential risks to an organisation – Piggybacking

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Denial-of-service attacks come in a variety of forms and aim at a variety of services. There are three basic types of attack:

◦ consumption of scarce, limited, or non-renewable resources ◦ destruction or alteration of configuration information ◦ physical destruction or alteration of network components

Consumption of Scarce ResourcesComputers and networks need certain things to operate: network bandwidth, memory and disk space, CPU time, data structures, access to other computers and networks, and certain environmental resources such as power, cool air, or even water. Network Connectivity Denial-of-service attacks are most frequently executed against

network connectivity. The goal is to prevent hosts or networks from communicating on the network. An example of this type of attack is the "SYN flood" attack described in http://www.cert.org/advisories/CA-1996-21.html

In this type of attack, the attacker begins the process of establishing a connection to the victim machine, but does it in such a way as to prevent the ultimate completion of the connection. In the meantime, the victim machine has reserved one of a limited number of data structures required to complete the impending connection. The result is that legitimate connections are denied while the victim machine is waiting to complete bogus "half-open" connections.

You should note that this type of attack does not depend on the attacker being able to consume your network bandwidth. In this case, the intruder is consuming kernel data structures involved in establishing a network connection. The implication is that an intruder can execute this attack from a dial-up connection against a machine on a very fast network. (This is a good example of an asymmetric attack.)

P3.3 - Potential risks to an organisation – DDos

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Bandwidth Consumption

An intruder may also be able to consume all the available bandwidth on your network by generating a large number of packets directed to your network. Typically, these packets are ICMP ECHO packets, but in principle they may be anything. Further, the intruder need not be operating from a single machine; he may be able to coordinate or co-opt several machines on different networks to achieve the same effect.

Consumption of Other Resources

In addition to network bandwidth, intruders may be able to consume other resources that your systems need in order to operate. For example, in many systems, a limited number of data structures are available to hold process information (process identifiers, process table entries, process slots, etc.). An intruder may be able to consume these data structures by writing a simple program or script that does nothing but repeatedly create copies of itself. Many modern operating systems have quota facilities to protect against this problem, but not all do. Further, even if the process table is not filled, the CPU may be consumed by a large number of processes and the associated time spent switching between processes. Consult your operating system vendor or operating system manuals for details on available quota facilities for your system.

P3.3 - Potential risks to an organisation – DDos

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Using Your Own Resources Against You An intruder can also use your own resources against you in unexpected ways. One example is described in http://www.cert.org/advisories/CA-1996-01.html In this attack, the intruder uses forged UDP packets to connect the echo service on one machine to the charged service on another machine. The result is that the two services consume all available network bandwidth between them. Thus, the network connectivity for all machines on the same networks as either of the targeted machines may be affected.

P3.3 - Task 3 – Define and explain the potential risk to an organisation’s e-commerce system from DDos attacks and Piggybacking.

P3.3 - Potential risks to an organisation – DDos

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Page Jacking or Spyware is software that collects and transmits user specific behaviour and information, with or without permission. Sometimes, permission to collect and transmit is assumed to have been given simply by the act of installing software or loading a Web page.

Like ads, data collection can be okay if done with consent or for a reasonable purpose. For example, software that transmits user specific information for the legitimate purpose of confirming eligibility for updates or upgrades should not be classed as spyware. Programmers are entitled to ensure that their software is not being pirated, and that the users of pirated software are not receiving the same benefits as legitimate users.

Pagejacking and Spyware is a type of software intrusive camera that can be installed on computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's personal computer. Sometimes, however, spywares such as keyloggers are installed by the owner of a shared, corporate, or public computer on purpose in order to secretly monitor other users, registering key presses and passwords.

While the term spyware suggests software that secretly monitors the user's computing, the functions of spyware extend well beyond simple monitoring. Spyware programs can collect various types of personal information, such as Internet surfing habits and sites that have been visited, but can also interfere with user control of the computer in other ways, such as installing additional software and redirecting Web browser activity. Spyware is known to change computer settings, resulting in slow connection speeds, different home pages, and/or loss of Internet connection or functionality of other programs.

P3.4 - Potential risks to an organisation – Page Jacking

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

CoolWebSearch, a group of programs, takes advantage of Internet Explorer vulnerabilities. The package directs traffic to advertisements on Web sites including coolwebsearch.com. It displays pop-up ads, rewrites search engine results, and alters the infected computer's hosts file to direct DNS lookups to these sites.

HuntBar, aka WinTools, was installed by an ActiveX drive-by download at affiliate Web sites, or by advertisements displayed by other spyware programs—an example of how spyware can install more spyware. These programs add toolbars to Internet Explorer, track browsing behaviour, redirect rival references, and display advertisements.

MyWebSearch has a plug-in that displays a search toolbar near the top of a browser window, and it spies to report user search-habits. MyWebSearch is notable for installing over 210 computer settings, such as over 210 MS Windows registry keys/values. Beyond the browser, it has settings to affect Outlook, email, HTML, XML, etc.

Zango (formerly 180 Solutions) transmits detailed information to advertisers about the Web sites which users visit. It also alters HTTP requests for rival advertisements linked from a Web site, so that the advertisements make unearned profit for the 180 Solutions company. It opens pop-up ads that cover over the Web sites of competing companies.

Zlob trojan, or just Zlob, downloads itself to a computer via an ActiveX codec and reports information back to the company. Some information can be the search-history, the Websites visited, and even keystrokes. More recently, Zlob has been known to hijack routers set to defaults.

P3.4 - Task 4 – Define and explain the potential risk to an organisation’s e-commerce system from Spyware attack.

P3.4 - Potential risks to an organisation – Page Jacking

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.5 - Potential risks to an organisation – Passwords

Choosing a secure password is one of the easiest and least expensive ways to guard against unauthorized access. Unfortunately, too many people prefer to use an easy-to-remember password.

If your password is obvious to you, however, it may also be easy for a hacker to figure out. The following guidelines for selecting passwords should be part of your organisation’s security policy. It is especially important for network administrators to choose difficult passwords, and also to keep passwords confidential and to change them frequently.

Tips for making and keeping passwords secure include the following:◦ Always change system default passwords after installing new

programs or equipment. For example, after installing a router, the default administrator’s password on the router might be set by the manufacturer to be “1234” or the router’s model number.

◦ Do not use any word that might appear in a dictionary. Hackers can use programs that try a combination of your user ID and every word in a dictionary to gain access to the network. This is known as a dictionary attack, and it is typically the first technique a hacker uses when trying to guess a password (besides asking the user for her password).

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.5 - Potential risks to an organisation – Passwords◦ Do not use familiar information, such as your name, nickname, birth

date, anniversary, pet’s name, child’s name, spouse’s name, user ID, phone number, address, or any other words or numbers that others might associate with you.

◦ Make the password longer than eight characters—the longer, the better. Some operating systems require a minimum password length (often, eight characters), and some might also restrict the password to a maximum length.

◦ Choose a combination of letters and numbers; add special characters, such as exclamation marks or hyphens, if allowed. Also, if passwords are case sensitive, use a combination of uppercase and lowercase letters.

◦ Change your password at least every 60 days, or more frequently, if desired. If you are a network administrator, establish controls through the NOS to force users to change their passwords at least every 60 days. If you have access to sensitive data, change your password even more frequently.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.5 - Potential risks to an organisation – Passwords

◦ Do not write down your password or share it with others. ◦ Do not reuse passwords after they have expired.◦ Use different passwords for different applications. For example,

choose separate passwords for your e-mail program, online banking, remote access connection, dial-up connection, and so on. That way, if someone learns one of your passwords she won’t necessarily be able to access all of your secured accounts.

Password guidelines should be clearly communicated to everyone in your organization through your security policy. Although users might grumble about choosing a combination of letters and numbers and changing their passwords frequently, you can assure them that the company’s financial and personnel data is safer as a result. No matter how much your colleagues protest, do not back down from your password requirements. Many companies mistakenly require employees only to use a password, and don’t help them choose a good one. This oversight increases the risk of security breaches.

P3.5 - Task 5 – Define and explain the potential risk to an organisation’s e-commerce system from losing or inadequate use of Passwords.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.6 - Potential risks to an organisation – TransactionsReturns – All purchases on the Internet except food have a cooling off period under the Distance Sale Regulation. This will apply if: you bought certain goods and services which the law says

aren't covered by a cooling-off period you're a business buyer you bid for something in an online auction you bought from a private individual you agreed for a service, such as broadband, to start straight

away. This depends on when the trader gives you certain information.

It is not uncommon for users in shop to buy things for an occasion and then return them after use for a full refund. On the internet this is more difficult to police and more difficult to confront. In a high street shop they can check it there and then.The 7 day cooling off period needs to take into consideration the time it takes to post and return, in theory from the moment the user declares that they are returning it then the period comes to an end.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.6 - Potential risks to an organisation – Transactions

If you bought any of the following goods or services, you will not have an automatic right to a cooling-off period: something personalised or made-to-order something perishable - for example, food or flowers newspapers or magazines a CD, DVD or computer software where the security seal has been broken something bought by bidding through an online auction something that’s price is dependent on changes in the financial market -for

example, central heating oil a new service that starts immediately - for example, paying for access to a

website accommodation, transport, catering and leisure services to be delivered on a

specific date - for example, train tickets, hotel and restaurant bookings, taxis and theatre tickets

gaming, betting or lottery services timeshare agreements something where the trader has informed you before finalising the contract in

writing or email that you will not be allowed to cancel once the service has begun.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.6 - Potential risks to an organisation – TransactionsPayments – People generally do not trust payment systems on line, the added security often adds to these problems rather than alleviated the issue. Having an amazon account, playing apps and accidently tapping for more fruit drop lives can rack up an automatic bill. Buy now in e-bay commits the user to buy but still has a back out clause.There are thousands of cases on the internet of children running up bills on their parents online accounts, of children accidently buying goods off e-bay.Similarly keeping track of payments and how much money spent is easier on the high street because the payments are more personalClick on the images on the right for examples.P3.6 - Task 6 – Define and explain the potential risk to an organisation’s e-commerce system from Payments and Return issues.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.7 - Potential risks to an organisation – e-commerce risks P3.7 - Task 7 - Create a table listing all the various types of

threats to the an e-commerce system and their data. In a second column, describe in detail the nature of the threat.

Threats to Company Data

Nature of the Threat Risk of Damage Impact and response

A Virus Attack External attack running the risk of corrupting data.

Medium to data, High to Customer Account Information

Payment and Returns issues

Identity Theft of a Staff Member

External Piggybacking on Network

Successful Hacking attempt

Successful Denial of Service Attack

Loss of control through Spyware and Malware

Password Theft

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.7 - Potential solutions for an organisation – Firewalls A firewall is a security-conscious router that sits between the Internet and your network with

a single purpose: preventing external attacks. The firewall acts as a security guard between the Internet and your Network. All network traffic into and out of the system must pass through the firewall, which prevents unauthorised access to the network. Some type of firewall is a must-have if your network has a connection to the Internet, whether that connection is broadband, T1, or some other high-speed connection. Without it, sooner or later a hacker will discover and breach your unprotected network.

You can set up a firewall using two basic ways. The easiest way is to purchase a firewall program, which is basically a self-contained router with built-in firewall features like one Alarm or Sophos. Most firewall appliances include a Web-based interface that enables you to connect to the firewall from any computer on your network using a browser. You can then customise the firewall settings to suit your needs.

Alternatively, you can set up a server computer to function as a firewall computer (SSL). The server can run just about any network operating system, but most dedicated firewall systems run Linux. Whether you use a firewall appliance or a firewall computer, the firewall must be located between your network and the Internet,firewall is connected to a network hub, which is, in turn, connected to the other computers on the network. The other end of the firewall is connected to the Internet. As a result, all traffic from the LAN to the Internet and vice versa must travel through the firewall.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.7 - Potential solutions for an organisation – SSL

SSL (Secure Sockets Layer) is a method of encrypting TCP/IP transmissions – including Web pages and data entered into Web forms - en route between the client and server using public key encryption technology. If you trade stocks or purchase goods on the Web, for example, you are most likely using SSL to transmit your order information. SSL is popular and used widely. The most recent versions of Web browsers, such as Firefox and Internet Explorer, include SSL client support in their software.

If you have used the Web, you have probably noticed that URLs for most Web pages begin with the HTTP prefix, which indicates that the request is handled by TCP/IP port 80 using the HTTP protocol. When Web page URLs begin with the prefix HTTPS (which stands for HTTP over Secure Sockets Layer or HTTP Secure), they require that their data be transferred from server to client and vice versa using SSL encryption. HTTPS uses the TCP port number 443, rather than port 80. After an SSL connection has been established between a Web server and client, the client’s browser indicates this by showing a padlock in the lower-right corner of the screen in the browser’s status bar, in the URL textbox, or elsewhere.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

M2.1 - Potential solutions for an organisation – SSL

Each time a client and server establish an SSL connection, they also establish a unique SSL session, or an association between the client and server that is defined by an agreement on a specific set of encryption techniques. An SSL session allows the client and server to continue to exchange data securely as long as the client is still connected to the server.

An SSL session is created by the SSL handshake protocol, one of several protocols within SSL, and perhaps the most significant. As its name implies, the handshake protocol allows the client and server to authenticate (or introduce) each other and establishes terms for how they will securely exchange data.

For example, when you are connected to the Web and you decide to open your bank’s account access URL, your browser initiates an SSL connection with the hand shake protocol.

M2.1 - Task 8 – Define and explain how Firewalls and SSL security can protect information on an organisation’s e-commerce system.

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

M2.2 - Potential solutions for an organisation – Digital Certificate

A digital certificate is a password-protected and encrypted file that holds an individual’s identification information, including a public key. In the context of digital certificates, the individual’s public key verifies the sender’s digital signature. An organisation that issues and maintains digital certificates is known as a CA (certificate authority). For example, on the Internet, certificate authorities such as VeriSign will, for a fee, keep your digital certificate on their server and ensure to all who want to send encrypted messages to you (for example, an order via your e-commerce site) that the certificate is indeed yours.

The use of certificate authorities to associate public keys with certain users is known as PKI (public key infrastructure).

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

Encryption refers to the process of translating plain text information into a secret code so that unauthorized users can’t read the data. Encryption isn’t new. Secret agents have long used codebooks to encode messages, and breaking the code has always been one of the top priorities of counter-intelligence.

Both Windows 2000 Server and Windows Server 2003 have a feature called Encrypted File System, or EFS for short, that lets you save data on disk in an encrypted form. This prevents others from reading your data even if they manage to get their hands on your files.

Encryption is especially useful in environments where the server can’t be physically secured. If a thief can steal the server computer (or just its hard drive), he or she may be able to crack through the Windows security features and gain access to the data on the hard drive by using low-level disk diagnostic tools. If the files are stored in encrypted form, however, the thief’s efforts will be wasted because the files will be unreadable.

All forms of encryption use some sort of key to encrypt and decrypt the data. In World War II and Cold War spy movies, the key is a codebook that has a list of code words or phrases that match up to real words or phrases.

M2.2 - Potential solutions for an organisation – Encryption

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

The most basic type of data encryption, called synchronous data encryption, uses numeric keys that are used to apply complex mathematical operations to the source data in order to translate the data into encrypted form. These operations are reversible, so if you know the key, you can reverse the process and decrypt the data. For example, suppose that the encryption technique is as simple as shifting every letter of the alphabet up by the value of the key. Thus, if the key is 3, then A becomes D, B becomes E, etc. The message “Elementary, my dear Watson” becomes “Hohphqwdub, pb ghdu Zdwvrq.” This message is incomprehensible, unless you know the key. Then, reconstructing the original message is easy.

The actual keys and algorithms used for cryptography are much more complicated. Keys are typically binary numbers of 40 or 128 bits. The classic dilemma of cryptography is this: How can I securely send the key to the person with whom I want to exchange messages? The answer is you can’t. You can’t encrypt the key, because the other person would need to know the key in order to decrypt it. That’s where public key encryption comes into play. Public key encryption is a technique in which two keys are used: a private key and a public key. The keys are related to each other mathematically. Either of the keys can be used to encrypt the data, but the encryption process isn’t completely reversible: You have to have the private key in order to decrypt the data.

Other Methods include:◦ transposition - characters switched around◦ Substitution - characters replaced by other characters

Cryptography serves 3 purposes:◦ Helps to identify authentic users◦ Prevents alteration of the message◦ Prevents unauthorised users from reading the message

◦ Encryption Keys◦ Sent with, sent after, kept on network of user and client.

M2.2 - Potential solutions for an organisation – Encryption

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

The best way to protect your network from virus infection is to use an antivirus program. These programs have a catalogue of several thousand known viruses that they can detect and remove. In addition, they can spot the types of changes that viruses typically make to your computer’s files, thus decreasing the likelihood that some previously unknown virus will go undetected. The two best known antivirus programs for Windows are Norton AntiVirus and McAfee’s VirusScan.

The people who make antivirus programs have their fingers on the pulse of the virus world and frequently release updates to their software to combat the latest viruses. Because virus writers are constantly developing new viruses, your antivirus software is next to worthless unless you keep it up to date by downloading the latest updates (Dat files). The following are several approaches to deploying antivirus protection on your network:

You can install antivirus software on each network user’s computer. This technique would be the most effective if you could count on all your users to keep their antivirus software up to date. Because that’s an unlikely proposition, you may want to adopt a more reliable approach to virus protection.

Managed antivirus services place antivirus client software on each client computer in your network. Then, an antivirus server automatically updates the clients on a regular basis to make sure that they’re kept up to date.

Server-based antivirus software protects your network servers from viruses. For example, you can install antivirus software on your mail server to scan all incoming mail for viruses and remove them before your network users ever see them.

Some firewall appliances include antivirus enforcement checks that don’t allow your users to access the Internet unless their antivirus software is up to date. This type of firewall provides the best antivirus protection available.

M2.2 - Task 9 – Define and explain how Antivirus software, Encryption and Digital Certificates can protect information on an organisation’s e-commerce system.

M2.2 - Potential solutions for an organisation – Antivirus

Antivirus Digital Certificate Encrytption

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

LO2 Understand the factors that influence website performance

Since the Internet first went public in 1992 there has been case after case of attack, breaches, viruses, and incident and even with new technologies, improved security, SSL, cloud computing and biometrics, the problems continue. Viruses are not such a threat as they used to be but the American Government still used one to disable the Iranian Nuclear program in 2012.

Firewalls have been improved immeasurably but Sony was still hacked. Single fraudsters like Kevin Mitnick are more rare but LulzSec has recently hacked the Twitter Accounts of North Korea. High profile cases are known like Wikileaks and the recent Facebook hack but the best forms are rarely caught. Click here and here for recent news.

M2.3 – Task 10 - Research the impact that 3 different cases of website security breaches have had on society.Three cases should be discussed from the three categories, at least one from each category, discussing the threat, the impact on society and how the threat was resolved.

Case examples could include:◦ Viruses, Trojans and Worms (Sobor, iloveyou, Lovesan)◦ Hackers (Adrian Lamo, Kevin Mitnick, MafiaBoy) Sony, Facebook and Twitter◦ Identity theft (Abraham Abdallah)◦ Phishing (Nigerian Oil, 180 Solutions)

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8 9 10

P3.1 - Task 1 – Define and explain the potential risk to an organisation’s e-commerce system from hacking attacks and viruses.P3.2 - Task 2 – Define and explain the potential risk to an organisation’s e-commerce system from Fraud and Phishing scams and ID Theft.P3.3 - Task 3 – Define and explain the potential risk to an organisation’s e-commerce system from DDos attacks and Piggybacking.P3.4 - Task 4 – Define and explain the potential risk to an organisation’s e-commerce system from Spyware attack.P3.5 - Task 5 – Define and explain the potential risk to an organisation’s e-commerce system from losing or inadequate use of Passwords.P3.6 - Task 6 – Define and explain the potential risk to an organisation’s e-commerce system from Payments and Return issues.P3.7 - Task 7 - List all the various types of threats to the an e-commerce system and their data and describe in detail the nature of the threat.M2.1 - Task 8 – Define and explain how Firewalls and SSL security can protect information on an organisation’s e-commerce system.M2.2 - Task 9 – Define and explain how Antivirus software, Encryption and Digital Certificates can protect information on an organisation’s e-commerce system.M2.3 – Task 10 - Research the impact that 3 different cases of website security breaches have had on society.

Task List

Scenario Criteria Tasks Assessment1 2 3 4 5 6 7 8