E-commerce and Web presence: The risks and threats
By Marc Gartenberg
February 12, 2004 12:00 PM ET
Computerworld - It's always a pleasant surprise when a day goes by without another worm or some form of exploitable vulnerability. That's because we're in shark-infested waters, and now is the time to really focus, dedicate resources and re-evaluate our strategic and tactical Web commerce plans. Let's face it, e-commerce is a target (and a profitable one at that), and it's never too soon to obtain executive acceptance for risk management and contingency planning. E-commerce has a variety of business and technology drivers, and these come with both benefits and risks. Developing an appropriate strategy includes factoring in the benefits while weighing the risks, which include fraud, loss of intellectual property, damaged customer and partner relationships, unforeseen costs, public relations debacles and business disruptions. Keep in mind that the three dimensions of security -- confidentiality, integrity and availability -- require that a company develop a set of e-commerce policies involving authorization and accountability while simultaneously focusing on potential threats and vulnerabilities. Whew. Well, if it was easy, anyone could do it. Keeping your site secure There are a number of ways and means to secure sites and transactions. Among them are the fundamental crypto building blocks that include encryption using symmetric and asymmetric-based key systems. There are also block and stream ciphers, MAC implementations, hash functions and symmetric cipher-based functions. Key management is critical. When Whitfield Diffie and Martin Hellman, the inventors of public-key cryptography, developed their initial algorithm nearly 30 years ago, little did they realize that it would stand the test of time. Once again we see that simpler can indeed be better. There are several components of the key life cycle worth mentioning, since they essentially mitigate cryptanalysis, exhaustive searches, social engineering and system compromise. These include key establishment, key backup/recovery/escrow, rekeying, key revocation and key expiration. Systems administrators need to have these factors in mind when using a key-based system. The facts speak for themselves. In the 2003 Computer Security Institute/FBI Computer Crime and Security Survey, the average reported loss from computer attacks was approximately $2.7 million per incident, and insiders topped the list of attack sources. For these reasons and others, system managers and organizations as a whole have cause for concern. Before you can even think of developing a strategy, though, you must consider the following:
Who are your adversaries? These might include hackers, script kiddies, hactivists (to achieve some political cause), computer criminals (hacking for profit or financial gain), virus and worm writers, insiders and, last but not least, cyberterrorists targeting critical infrastructure and using attacks as a force multiplier.
What are the targets? These might include information, computer and network resources, enterprise infrastructure and hardware. Some physical vulnerabilities that could lead to unauthorized access to these targets include unlocked doors and cabinets, exposed systems and network links, fragile power sources, limited video surveillance and monitoring, and poor authentication. System vulnerabilities include the infamous unsecured or default "guest" account, ad hoc trust relationships between systems, poor access controls, limited authentication and nonrepudiation facilities, collocation of systems, and unknown and untracked remote access points. (Not knowing your security perimeter is a disaster waiting to happen.)
The development and implementation of encryption, PKI and other authentication, and validation through certificate management, are a step in the right direction and address some of the aspects of enhanced secure digital payment systems.
Solving application issues over the WAN requires careful consideration. Based on their independent research, Forrester Consulting offers recommendations on how to tackle application performance issues, insufficient bandwidth and the inability to quickly restore users in a disaster.
Security is not an option. This KnowledgeVault Series offers professional advice how to be proactive in the fight against cybercrimes and multi-layered security threats; how to adopt a holistic approach to protecting and managing data; and how to hire a qualified security assessor. Make security your Number 1 priority.
New IP-based communications systems are being deployed by small and midsized businesses at a rapid rate. Learn how these organizations are enabling faster responsiveness, creating better customer experiences, speeding office or mobile interactions, and dramatically reducing existing communications costs.
Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring...
This white paper from Forrester Research Inc., helps break PCI into understandable components. Security and risk professionals will gain knowledge and insight into...
This white paper describes the business challenges and opportunities that are driving interest in Identity Governance while discussing considerations your organization should make...
When it comes to disaster recovery, rapidly growing data volumes, distributed computing models, and new technologies all combine to present an ever-changing playing...
Traditional disaster recovery solutions are often too expensive, complex and unreliable to meet business requirements. As a result, IT departments are hesitant to...
Maintaining peak performance while simultaneously addressing the root cause of SAN errors is challenging. Learn the most common SAN problems and explore new...
Go inside Quantum's scalable, high-performance, multi-protocol new DXi deduplication appliances, designed to make backup much more effective. Discover how the new future-proof DXi6700...
Discover how the new DXi 6700 series of deduplication appliances provide investment protection and a future-proof feature set, all while delivering fast, scalable,...
When it comes to disaster recovery, rapidly growing data volumes, distributed computing models, and new technologies all combine to present an ever-changing playing...
Free Insider Guide