E Comm Unit 4

E COMMERCE
SEMESTER - 6
UNIT - 4
HICOLLEGE.IN
SECURITY THREATS AND ISSUES
Financial Fraud:
Credit Card Fraud: Hackers steal credit card details through various means
(phishing, skimming, malware) and use them for unauthorized purchases.
Refund Fraud: Fraudsters claim they haven't received items or use stolen
credit cards to purchase goods and then request refunds.
Chargebacks: Customers dispute legitimate transactions due to
misunderstandings or fraudulent activity, leading to financial losses for
businesses.
Data Breaches:
Phishing Attacks: Deceptive emails or websites trick users into revealing

sensitive information like passwords or credit card details.
Malware and Ransomware: Malicious software can steal customer data,
disrupt website functionality, or hold data hostage for ransom.
SQL Injection: Hackers inject malicious code into website forms to gain
unauthorized access to databases containing sensitive information.
Cross-Site Scripting (XSS): Attackers inject malicious scripts into websites,
allowing them to steal user data or redirect them to phishing sites.
Other Security Threats:
DDoS (Distributed Denial-of-Service) Attacks: Overwhelms websites with

traffic, making them inaccessible to legitimate users.
Brute Force Attacks: Hackers try to guess passwords through automated
attempts to gain unauthorized access.
Man-in-the-Middle Attacks: Hackers intercept communication between
users and the website, potentially stealing data or manipulating
transactions.
Bots: Malicious bots can automate tasks like scraping product information,
creating fake accounts, or launching fraudulent transactions.
HiCollege Click Here For More Notes

03
CYBER CRIMES, CREDIT CARD FRAUDS/THEFT,
IDENTITY FRAUD, SPOOFING, SNIFFING, DOS AND
DDOS ATTACKS, SOCIAL NETWORK SECURITY
ISSUES, MOBILE PLATFORM SECURITY ISSUES,
CLOUD SECURITY ISSUES
Cyber Crimes:
E-commerce fraud: Encompasses various illegal activities targeting online

stores, including credit card fraud, identity theft, and manipulating
transactions for financial gain.
Data breaches: Unauthorized access to and theft of customer data,
including personal information, financial details, and purchase history.
Ransomware attacks: Malicious software that encrypts data, making it
inaccessible until a ransom is paid.
Credit Card Frauds/Theft:
Phishing attacks: Deceptive emails or websites that trick users into

revealing credit card details.
Skimming: Illegally capturing credit card information through devices
installed on card readers or ATMs.
Card-Not-Present (CNP) fraud: Fraudulent transactions conducted online or
over the phone without the physical presence of the card.
Identity Fraud:
Stealing personal information: Hackers obtain personal details like names,

addresses, Social Security numbers, to impersonate individuals and make
unauthorized purchases.
Account takeover: Gaining unauthorized access to existing customer
accounts to make fraudulent transactions.
Spoofing:
Email spoofing: Forging email addresses to appear legitimate and deceive

users into revealing sensitive information.
Website spoofing: Creating fake websites that closely resemble legitimate
e-commerce platforms to steal customer data.
HiCollege Click Here For More Notes 04

Sniffing:
Interception of data: Hackers capture sensitive information transmitted

over unsecured networks, such as credit card details or login credentials.
DoS and DDoS Attacks:
Denial-of-service (DoS) attacks: Overwhelming a website with traffic,

making it inaccessible to legitimate users.
Distributed denial-of-service (DDoS) attacks: Launching DoS attacks from

multiple compromised devices to amplify their impact.
Social Network Security Issues:
Data breaches: Social media platforms can be targets for data breaches,
exposing user information that could be used for identity theft or targeted
attacks.
Phishing scams: Social media platforms are often used to spread phishing
attacks that target users within social circles.
Fake accounts: Fraudsters create fake accounts to spread misinformation,

impersonate legitimate businesses, or scam users.
Mobile Platform Security Issues:
Malware: Malicious apps can steal user data, track activity, or even take
control of devices.
Unsecured Wi-Fi: Using public Wi-Fi networks for online transactions

exposes sensitive information to potential interception.
Lost or stolen devices: Devices containing payment information or login

credentials pose a security risk if lost or stolen.

Cloud Security Issues:
Data breaches: Cloud storage providers can be targeted by cyberattacks,

leading to the exposure of sensitive customer data stored in the cloud.
Misconfigurations: Improper cloud configurations can create vulnerabilities

that hackers can exploit.
Shared responsibility model: Both cloud providers and businesses using

cloud services share responsibility for securing data stored and processed in
the cloud.
TECHNOLOGY SOLUTIONS
Encryption is the cornerstone of safeguarding sensitive information in e-
commerce. It transforms readable data (plaintext) into an unreadable format
(ciphertext) using complex mathematical algorithms. This ciphertext can only
be deciphered with a specific key, ensuring that only authorized individuals can
access the original data.
Two Main Types of Encryption:
1. Secret Key Encryption (Symmetric Encryption):
This method utilizes a single shared secret key for both encryption and
decryption.
Imagine a locked box where the same key opens and closes it.
It's highly efficient for encrypting large amounts of data quickly.
Common examples include AES (Advanced Encryption Standard), DES
(Data Encryption Standard), and 3DES (Triple DES).
1. Public Key Encryption (Asymmetric Encryption):
This system employs a pair of mathematically linked keys: a public key

and a private key.
The public key is freely available for anyone to use for encryption, while
the private key is kept strictly confidential and used for decryption.
Think of it like a public mailbox with a unique slot and a personal key to
unlock the mailbox contents.

It's ideal for secure key exchange without the need for pre-shared
secrets.
Popular examples include RSA (Rivest–Shamir–Adleman), DSA (Digital
Signature Algorithm), and ECC (Elliptic Curve Cryptography).
Digital Certificates and Public Key Infrastructure (PKI):
Digital certificates play a crucial role in public key encryption by establishing

trust and authenticity. They are electronic documents that bind a public key to
a specific entity (e.g., a website, an individual). Public Key Infrastructure (PKI) is
a system that manages the issuance, distribution, revocation, and validation of
these digital certificates. Imagine PKI as a trusted authority that verifies the
legitimacy of public keys, preventing imposters from using forged keys for
malicious purposes.
Securing Communication Channels: Building a Secure Tunnel
Secure Sockets Layer (SSL) and Transport Layer Security (TLS):

These protocols are the backbone of secure communication on the
internet. They establish encrypted connections between web servers and
browsers, ensuring the confidentiality of data transmitted during online
transactions.
When you see the padlock symbol and "HTTPS://" in your browser
address bar, it indicates a secure connection protected by SSL/TLS.
This encryption safeguards sensitive information like credit card details,
login credentials, and personal data from being intercepted by hackers.
Virtual Private Network (VPN):

A VPN creates a secure tunnel over the public internet, encrypting all
traffic flowing between your device and a VPN server.
It's like building a private, encrypted pathway within the vast public
internet, protecting your data from unauthorized access on public Wi-Fi
networks or untrusted internet connections.

PROTECTING NETWORKS
Firewalls:
Act as the first line of defense, controlling incoming and outgoing network
traffic based on predefined security rules.
Block unauthorized access attempts and malicious traffic, preventing
cyberattacks like DDoS attacks.
Different types of firewalls exist, including packet-filtering firewalls,
application-level firewalls, and stateful firewalls.
Proxy Servers:
Intermediaries between devices and the internet, masking the user's IP

address and adding an extra layer of security.
Can filter web traffic, block malicious content, and enhance privacy.
Intrusion Detection and Protection Systems (IDS/IPS):
Monitor network traffic and system activity for suspicious behavior that
might indicate a cyberattack.
IDS systems detect potential threats, while IPS systems actively block them.
Help identify and respond to security incidents promptly.
Anti-Virus Software:
Protects devices and systems from malware, viruses, and other malicious
software that can compromise data or disrupt operations.
Regularly scans for and removes threats, preventing infections and potential
damage.

E Comm Unit 4

Uploaded by

Copyright:

Available Formats

E Comm Unit 4

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

E Comm Unit 4

Uploaded by

Copyright:

Available Formats

E COMMERCE

Phishing Attacks: Deceptive emails or websites trick users into revealing

Other Security Threats:

DDoS (Distributed Denial-of-Service) Attacks: Overwhelms websites with

HiCollege Click Here For More Notes

E-commerce fraud: Encompasses various illegal activities targeting online

Credit Card Frauds/Theft:

Phishing attacks: Deceptive emails or websites that trick users into

Stealing personal information: Hackers obtain personal details like names,

Email spoofing: Forging email addresses to appear legitimate and deceive

HiCollege Click Here For More Notes 04

Interception of data: Hackers capture sensitive information transmitted

DoS and DDoS Attacks:

Denial-of-service (DoS) attacks: Overwhelming a website with traffic,

Distributed denial-of-service (DDoS) attacks: Launching DoS attacks from

Social Network Security Issues:

Fake accounts: Fraudsters create fake accounts to spread misinformation,

Mobile Platform Security Issues:

Unsecured Wi-Fi: Using public Wi-Fi networks for online transactions

Lost or stolen devices: Devices containing payment information or login

HiCollege Click Here For More Notes 05

Data breaches: Cloud storage providers can be targeted by cyberattacks,

Misconfigurations: Improper cloud configurations can create vulnerabilities

Shared responsibility model: Both cloud providers and businesses using

Two Main Types of Encryption:

1. Secret Key Encryption (Symmetric Encryption):

1. Public Key Encryption (Asymmetric Encryption):

This system employs a pair of mathematically linked keys: a public key

HiCollege Click Here For More Notes 06

Digital Certificates and Public Key Infrastructure (PKI):

Digital certificates play a crucial role in public key encryption by establishing

Securing Communication Channels: Building a Secure Tunnel

Secure Sockets Layer (SSL) and Transport Layer Security (TLS):

Virtual Private Network (VPN):

HiCollege Click Here For More Notes 07

Intermediaries between devices and the internet, masking the user's IP

Intrusion Detection and Protection Systems (IDS/IPS):

HiCollege Click Here For More Notes 08

You might also like