E-Commerce Essay, Research Paper
Electronic commerce includes almost any exchange of electronic data related to a business operation. In this discussion, I will be focusing on the use of the Internet for business transactions. Companies that use the Internet as their major source of income have a big concern about electronic commerce security to keep them successful in their online business. Although the technology exists to prevent almost all types of aggression, the nature of the Internet makes accomplishment of security measures difficult. TCP/IP, the network protocol of most Internet use, it sill weak for security compromises (LOEW 134). A business security plan for securing electronic commerce must begin with a baseline. Firewalls and the use of encryption can only protect against 80% of all security threats. Common sense policy measures, such as proper configuration of computer systems and appropriate use of passwords, are often overlooked (RUSSELL 165). In the article, ?Connecting to The Internet: Security Considerations,? http://csrc.ncls.nist.gov/nistbul/cs193-07.txt, Bulletin. Reporting that ?in recent years, a number of security problems with the Internet have become apparent.? ?Crackers often roam the Internet with impunity, covering their tracks by moving from system to system.? In the rest of my discussion I will be focusing on different aspects of Internet security and E-commerce such as Commerce on the Internet, Electronic Commerce Systems, Business Security Strategies, Security Concepts, Risks of Internet Use, Internet System, and the future of Electronic Commerce Security. Direct sales via the Internet are expected to grow from $8 billion this year to anywhere from $50 to $250 billion by the end of the century. The amount of sales on the Internet may comprise 36% of direct sales in the year 2000 compared with 7% in 1996. The number of transactional sites on the World Wide Web (WWW) has been increasing around 1,700 for awhile, but is expected to reach 15,000 by the year 2001 (BERKLEY 6). The attractions of the Internet for conducting commerce are getting higher and conducting a transaction at one-sixth the cost of placing the same order through human operator (BERKELY 4). The use of the Internet for electron commerce now includes transaction types that formerly were considered too risky. In 1996 the San Francisco-based Lombard Institutional Brokerage began to offer customer the ability to sell and buy stocks over the Internet (DALE 7). Other brokerages, including Charles Schwab and Jack White & Co., have jumped on the business. In the same year, Currency Management Corp. (CMC) of London began offering foreign exchange trading in 27 currencies on the Internet (DALE 7). Although most published commentaries researched for this paper seem to be optimistic about the electronic commerce security issues, doubt currently restrict the use of the Internet for electronic commerce to a few risk takers. One survey of Internet users indicated that for 50% to 60% of the respondents, security is the main Internet usage issue (DALE 2). Most electronic commerce issues have long ago been solved in theory, and implementation of protocols and software solutions loom on the horizon. For the moment, many issues of concern still exist. Internet System The Internet developed through the 1960?s and 1970?s in a largely academic setting and emphasized connectivity as opposed to security (BULLETIC 4). In order to discuss security issues of electronic commerce, a brief summary of a few technical points concerning the Internet is necessary. A business maintains an Internet presence through an Internet server or host. The Internet presence may occur through a firm setting up its own server, such as a World Wide Web (WWW) page, or by leasing virtual real estate on someone else?s server, such as with an Internet cybermall (DEBORAH 357). Users access the business server through the Internet. A company Internet server may or may not have links to the company computer files. In the simple Web page advertisement, the server need not have any connection with the rest of a company?s computer system. In the Internet transaction site, where customers actually order products or initiate account transactions, the host must by linked to important company databases. The World Wide Web is the best known Internet connectivity system. Its characteristic HyperText Transfer Protocol (HTTP) allows the user to move around and between the World Wide Web sties by clicking on ?links.? Other systems, such as File Transfer Protocol (FTP) and Telnet, are commonly used to transfer information through the Internet. Between the user?s computer and the Internet there are actually several layers of Internet protocols (DEBORAH 217) that are largely invisible to the Internet user. TCP/IP (Transport Control Protocol/Internet Protocol) represents a collection of networking protocols and applications at the core of most Internet activity (DEBORAH 208). Risks of Internet The use of the Internet for electronic commerce increases a company?s business risks. Under the theory of liability, a company is potentially liable for damage to the computer system of an unaffiliated company and its customer for damage caused by invasion through the first company?s computer system (FRATO 8). The main types of security threats through the Internet include: Information Threats to Internet Servers. Intruders may penetrate the Internet server and gain access to sensitive information, such as customer credit card number stored there. Threats to the Corporate Network. Intruders may gain access via the Internet through security holes into the general corporate network/ Threats to Data Transmission. Corporate data transfer (e-mail, file downloads, web transactions) may be intercepted and compromised. Resources Threats to Service Availability. Invasions of the computer system could interrupt use of computer systems or even make the network crash. Threats from Repudiation. Fraud may be committed in an online transaction or the party may deny a transaction took place. Reputation If vulnerabilities of a company?s computer system are demonstrated or become known the reputation of the company will be harmed (FRATO 59). Technical descriptions of how attacks on a company computer via the Internet occur are beyond the scope of this paper. However, an overview of a few types of attacks will help with the later discussion of secure Internet commerce. Password based attacks involved some use of a password to gain access through security layers to privileged data or systems. A recent study found that 30% of all attacks were password based (LOEW 50). A brute force attack consists of attempting to use randomly generated passwords until entry is gained to a password-protected system. IP spoofing occurs when an attacker makes his computer appear to another computer or host to be a trusted party and tricks that computer or host into releasing sensitive data allowing the attacker?s computer access to a privileged system. IP spoofing can be technically difficult, but computer analysis indicates it is a significant security threat (LOEW 43). Network Snooping/Packet Sniffing involves intercepting packets or messages on the Internet between the sender or source and the intended destination host. Snooping or Sniffing is something like ?bugging? an old-fashioned voice communication such as a telephone line. Using this technique, an invader can capture company passwords and intercept sensitive messages. Snooping/Sniffing is one of the most difficult types of invasion to defend against, and in the last few years, hundreds of thousands of these types of attacks have occurred (LOEW 46). Security Concepts Two types of security measures in one estimate provide protection against 80% of all attacks on business computer systems (DEBORAN and G.T. 5). A firewall is a perimeter of security between a company?s Internet server and the company?s main computer network system (DEBORAH and G.T. 258). The firewall intercepts messages across the perimeter and determines whether the message should pass through. The firewall is designed to isolate a company network as much as possible from promiscuous access via the Internet. Encryption is a method of translating a message into a code using mathematical algorithm (DEBORAH and G.T. 147). In order to read the message the code must be ?unlocked? using an encryption key. The effectiveness of encryption depends to some extent on the complexity of the algorithm used to encrypt the message, and different technologies provide different levels of protection (DEBORAH and G.T. 148). One of the original encryption strategies involved distributing private keys to each individual involved in a communication network. This method, symmetric key cryptography, had the crucial disadvantage that it was logistically impossible to insure that each and every and only each and every bona fide member of the network possessed a key at all times (DEBORAH and G.T. 146). A more useful encryption strategy is asymmetric cryptography, which uses both a private and a public key. A public key is an encryption key that is generally published among network users for each user. By combining use of a public and private key, levels of security can be controlled and other security features, such as authentication and integrity may be introduced (FRATO 13). Although public/private key encryption may provide a solution to virtually any security problem, in the practice the use of encryption is limited by the fact that the computational demands of complex schemes overburden available resources and prevent prompt transmission of message (FRATO 15). User authentication is an important part of any Internet security system. Authentication assures that a party in an Internet transaction is the person whom they say they are. Authentication methods can be classified into the following categories: What you know. The combination of a user identifier and password is the oldest and most common authentication method. However, it is also the easiest to break. The use of one-time passwords that are created in advance is one advantage that makes user authentication more secure. What you are. A type of authentication in this category uses biometrics systems to identify a user based on physical attributes, such as fingerprints or retinal scans. Some systems on the market look at physical attributes of the user?s computer to verify identify. This type of authentication is at present less commonly used than other methods. What you have. This form of authentication is based on some device in the possession of the user, such as smart cards or disks, which contain miniature center procession unit (CPU). Such devices communicate with the computer electronically to exchange information similar to a password or may be programmed to release a time-based authentication password (FRATO 16). Regardless of the care with which an encryption scheme is designed, there always remains the possibility of passwords or authentication devices being stolen and used in digital identify fraud. A potentially more reliable method of establishing the identities of parties on the Internet through digital signatures is the use of certificates. A certificate is a digital document with identification information and a public key. A standard format known as X.509 is usually used (FRATO 15). The use of a certificate requires issuing the document to an individual, much like a driver?s license or social security number is issued. The issuing of certificates and maintaining a server making the information available to electronic commerce participants in order to verify identity requires a trusted third party or Certificate Authority (CA). Several CA?s, including GTE, Veri Sign Inc., and Northern Telecom, currently have certification schemes on the market (IMPROVED VPN 7). However, a problem with certification remains that there is no one agency universally recognized as a CA and no legal mechanism to handle the liability issue involved (IMPROVED VPN 7). One of the main security flaws of the Internet is an inherent technological flaw caused by decades of development with little attention to security issues. As security holes are uncovered, software manufactures modify their products using ?patches? (DEBORAH AND G.T. 143). ? Through such piecemeal modifications, Internet protocols tend towards higher security (DEBORAH AND G.T. 143)?. However, only systematic change of protocols will thoroughly address security concerns. Short of introduction of totally new Internet protocols, which is impractical, development of security-enhanced versions compatible with current protocols offers promise. Secure Sockets Layer (SSL) protocol, developed by Netscape Communications, works at the TCP/IP level and is largely invisible to the user. Secure HyperText Transfer Protocol (S-HTTP) works at a higher level and requires more user interaction. Many other secure protocols and channels are in the works, including PCT by Microsoft and IKP by IBM (DALE 4). Business Security Strategies A company?s security strategy for electronic commerce must be a corporate-wide strategy for all Internet and computer use. A security hole at any level could compromise the highest degree of security at another level. The main areas of Internet security concerns are: The Internet connection. The cornerstone of security here is the firewall. Connections with Internet providers must also be secure. A security flaw within a provider will also open the company to attack. End-user services. Internet services used by company employees, such as e-mail and news services, must be secure. Business services. The company?s Internet commerce Web server and all other Internet based services must be secured (DALE 12). Obviously, a company must first decide on the scope of its Internet commerce and other usage before developing a security plan. The basic concept of developing a security plan is risk analysis, in which all aspects of a company?s operations are examined for security flaws and the minimization of various risks are evaluated according to some type of cost/benefit analysis. However, a growing number of experts believe that such complicated and costly approach to Internet security may not be warranted because of the amount of guesswork involved in predicting risks (BULLETIN 2). These experts advocate a baseline controls approach to Internet security issues (BULLETIN 3). The baseline controls approach calls for implementing the first phase, according to standards of due diligence, basic technological and policy measures of Internet security, such as firewalls, secure protocols, employee Internet usage policies, and security management procedures (password issuing, security auditing, etc). An additional phase would involve looking at security issues specific to the unique aspects of a company?s operations and implementing additional measures according to the same standards of due diligence. Proponents argue that the baseline approach may provide the same degree of security as a systematic risk analysis approach and may protect a company against lawsuits if appropriate due care is exercised (BERKELEY 4). Electronic Commerce Systems Several alternative payment systems have been worked out using security techniques discussed in this paper and are currently being offered for secure interactions on the Internet. These systems will be briefly discussed. Electronic Money (E-money) The system described has been developed by Digicash (BERKELEY 339). In this system a digital system has been developed to mimic cash transactions on the Internet. Banks issue e-money customers digital ?coins? that are stored on the customer?s PC hard drive. The customer downloads coins from the bank server, where the customer?s account is debited. The coins are ?blinded? using an encryption envelope so that the coins will appear anonymous to the bank or anyone else, except to the customer, who knows a serial number for tracking purposes. The coins are then sent electronically to a merchant during a transaction. The merchant verifies the money at the merchant bank then deposits the coins. All merchants and customers must have special account to participate in the scheme. The main drawback of the Digicash e-money system is that merchant banks must have public keys of all the banks their customer use, a state of affairs that would practically very difficult to maintain. Also, customers lose FIC protection once money from their account is transferred into e-money (SOURCE ). Offline credit card processing system In a system developed by First Virtual Holdings, Inc., the company acts as a clearinghouse for the Internet transactions and communicates with customers via e-mail. A customer must set up an account with First Virtual and communicates over the phone to supply credit card information and to select a secure password. When a customer makes an order during an electron transaction, the merchant contact First Virtual to request authorization using customer-supplied information but not including credit card numbers. First Virtual then e-mails the customer to verify the transaction and if a favorable response is received, the First Virtual assures the merchant the transaction is valid. The main security feature of this system is that customer credit card numbers are not sent over the Internet, thereby relieving the merchant of liability in protecting customer credit card information. Disadvantages include the reliance on relatively unsecured e-mail for some degree of sensitive personal data and merchant liability under existing laws for fraud (SOURCE ). On-line credit card processing system A system developed by CyberCash, Inc. relies on powerful encryption of credit card numbers using free proprietary software. Customers register with CyberCash to set up an identity on the system and are assigned a private encryption key. Merchants are also required to load proprietary software. When a customer initiates a transaction, the merchant?s software prompts the customer?s software to open a digital ?wallet? and the merchant receives the customer?s credit card information encrypted with a private key. The merchant adds merchant information and sends the information to CyberCash. CyberCash is able to use public and private keys to decode customer and merchant information and obtains credit card authorization through standard means. If the cardholders bank authorizes the transaction, the merchant is notified, who in turn informs the customer of the completed transaction. An advanced version of CyberCash?s model, Secure Electron Transaction (SET) has been adopted as a payment protocol by MasterCard, Visa, and major Internet Software companies (TADJER 4). Virtual banking has gained a solid foothold on the Internet. It is estimated that about 4.6 million customers do banking via the Internet (TADJER 5). One of the first Internet virtual banking systems was designed by Security First Network Bank (SNFB), which exists practically only on the Internet (TADGER 4). The SFNB system has three main security features: 1. A Web platform with multi-level security technology, including privilege and authorization mechanisms for access to various function and commands. 2. A Firewall with audit and logging capabilities. 3. Netscape?s secure Web browser using the SSL protocol. Other Virtual banking options include banks sending customers proprietary software to do banking via direct modem connections and the cooperation with existing on-line services, such as American Online. In the later situation the bank is in effect outsourcing many security issues and responsibilities (TADJER 4). The Future of Electron Commerce Security In general, the challenge of improving the security of electronic commerce lies not so much in solving technical problems of security- in theory they are already solved, but in overcoming the institutional chaos of the many public and private organizations that control the Internet. The Internet is conglomeration of world wide TCP/IP networks that no one really controls (3, 366). Several organizations will be prominent in the future of electronic commerce. The development of TCP/IP is overseen by the Internet Engineering Task Force (IETF) and many Internet standards are recommended by the World Wide Web Consortium (W3C). Most current security devices cannot rely on TCP/IP, but future standards are likely to include security improvements in the TCP/IP protocol, of which users will largely be unaware (SOURCE ). Many new secure systems, such as SSL and SET, were developed by private companies but are on the way to universal acceptance amount Internet users. Java, the new programming language developed by Sun Microsystems, has much promise in security for network environments (DEBORAH AND G.T. 117). Some trade organizations have encouraged the formation of working groups to speed up the creation of secure electron commerce environments. The Financial Services Technology Consortium (FSTC) is comprised of banks, financial services firms, technology vendors, research laboratories, and government agencies (DEBORAH AND G.T. 117). The FSCT is working on converting the Electron Funds Transfer (EFT) protocol from a private to a public network, in order to create a common environment for secure electron commerce transactions. As a general rule, the risk of criminal attack on electronic commerce will be greatest in terms of large-scale attacks (DEBORAH and G.T. 80) as daily transaction become more and more secure.