ElectronicCommerce Infrastructure and Security Management-第四讲.pdfVIP

IS6523/6522: Electronic Commerce Infrastructure and Security Management Session 4: EC Security Infrastructure Security Tools (I) by Dr. Daniel Tse Minimizing Avenues of Attack •Understanding the steps an attacker will take enables to limit the exposure of the system and minimize the avenues an attacker might possibly exploit. Minimizing Avenues of Attack •The first step an administrator can take to minimize the possible attacks is to ensure that all patches for the operating system and the applications are installed. •The second step an administrator can take is to limit the services running on a system. •Another step that can be taken to minimize the possible avenues of attack is to provide as little information as possible on an organization and its computing resources. Why Certification Authority? •For secured e-commerce transactions under a PKI (Public Key Encryption) infrastructure, Certification Authorities are needed to: – Issue Digital Certificate to •Verify the identity of the certificate holder and its public key – Store and make available Digital Certificates so that other parties can communicate with the certificate holders securely using the public keys stored in Digital Certificates Digital Certificates •Electronic document attached to a public key by a trusted third party •Provide proof that the public key belongs to a legitimate owner and has not been compromised •Consist of: – Owner’s public key – Information unique to owner – Digital signatures of an endorser What is in a Certificate ? •The certificate has the following contents: – The CA’s name – The name of the certificate’s owner – The public key of the owner – The certificate’s validity period