A Tutorial on Web Security for E-Commerce.ppt

A Tutorial on Web Security for E-Commerce Web Concepts for E-Commerce Client/Server Applications Communication Channels TCP/IP Client/Server Applications Communication Channels OSI Model OSI Model cont’d TCP/IP and OSI Model TCP/IP and OSI Model TCP/IP and Addressing Security Threats Security threats A to D can be handled by providing secure transmission - cryptographic methods Threat E and similar types managed by access control methods Other types of security threats Illegal access of server computing system (webjacking) Illegal access client computing system Unauthorized use of client information Denial of Service Information Security Threats Internet Cryptography Techniques Transport Layer Security Application Layer Security Server Proxies and Firewalls Purpose of Cryptography Secure stored information - regardless if access obtained Secure transmitted information - regardless if transmission has been monitored Services Provided by Cryptography Confidentiality provides privacy for messages and stored data by hiding Message Integrity provides assurance to all parties that a message remains unchanged Non-repudiation Can prove a document came from X even if X’ denies it Authentication identifies the origin of a message verifies the identity of person using a computer system Cryptography Encryption Overview Plain text is converted to cipher text by use of an algorithm and key. Algorithm is publicly known Key is held private Three Main Categories Secret Key single key is used to encrypt and decrypt information Public/Private Key two keys are used: one for encryption (public key) and one for decryption (private key) One-way Function information is encrypted to produce a “digest” of the original information that can be used later to prove its authenticity Encryption Techniques Secret Key (Symmetric) Sender and receive have the same secret key that will encrypt and decrypt plain text Strength of encryption technique depends on key length Known symmetrical algorithm