1. Security requirement specification and risk analysis: This is the first phase in the security engineering life cycle. It collects information regarding assets of the organization that need to be protected, threat perception on those assets, associated access control policies, existing operational infrastructure, connectivity aspects, services required to access the asset and the access control mechanism for the services.
2. Security policy specification: This phase uses “security requirement specification” and “risk analysis report” as input and generates a set of e-commerce security policies. The policy statements are high-level rule-based and generic in nature, and, thereby, does not provide any insight to system implementation or equipment configuration.
3.Security infrastructure specification: This phase analyses the ““security requirement specification” and the “security policy specification” to generate a list of security tools that are needed to protect the assets. It also provides views on the location and purpose of the security tools.
4.Security infrastructure implementation: The organization, in this phase, procures, deploys, and configures the selected security infrastructure at the system level. 4.1e Security testing: In this phase, several tests are carried out to test the effectiveness of the security infrastructure, functionality of the access control mechanism, specified operational context, existence of known vulnerabilities in the infrastructure etc.
5. Requirement validation: This phase analyses the extent of fulfillment of the security requirements of the e-commerce organization by the corresponding security policy and the implemented security infrastructure. Change in the business goal, operational environment, and technological advancement may lead to a fresh set of security requirements and thereby, triggering a new cycle of the “security engineering life cycle”. Now, let us see the Security Requirements, Security Policy, Security Infrastructure, and Security Testing phases in greater detail.
6.Security requirements During this phase, the security needs of an enterprise are identified. These needs are governed by the necessity to protect the following security attributes:
7.Authentication: This is the ability to say that an electronic communication (whether via email or web) does genuinely come from who it purports to. Without face-to-face contact, passing oneself off as someone else is not difficult on the internet. Forging the “From:” field in an email header is a trivial matter, and far more sophisticated attacks are standard fare for hackers
In online commerce the best defence against being misled by an imposter is provided by unforgeable digital certificates from a trusted authority (such as VeriSign). Although anyone can generate digital certificates for themselves, a trusted authority demands real-world proof of identity and checks its validity before issuing a digital certificate. Only certificates from trusted authorities will be automatically recognized and trusted by the major web browser and email client software. Authentication can be provided in some situations by physical tokens (such as a driver’s license), by a piece of information known only to the person involved (e.g. a PIN), or by a physical property of a person (fingerprints or retina scans). Strong authentication requires at least two or more of these. A digital certificate provides strong authentication as it is a unique token (the certificate itself) and requires a password (something known only to the owner) for its usage.
8.Privacy: In online commerce, privacy is the ability to ensure that information is accessed and changed only by authorized parties. Typically this is achieved via encryption. Sensitive data (such as credit card details, health records, sales figures etc.) are encrypted before being transmitted across the open internet – via email or the web. Data which has been protected with strong 128-bit encryption may be intercepted by hackers, but cannot be decrypted by them within a short time. Again, digital certificates are used here to encrypt email or establish a secure HTTPS connection with a web-server. For extra security, data can also be stored long-term in an encrypted format.
9.Authorization: Authorization allows a person or computer system to determine if someone has the authority to request or approve an action or information. In the physical world, authentication is usually achieved by forms requiring signatures, or locks where only authorized individuals hold the keys. Authorization is tied with authentication. If a system can securely verify that a request for information (such as a web page) or a service (such as a purchase requisition) has come from a known individual, the system can then check against its internal rules to see if that person has sufficient authority for the request to proceed. In the online world, authorization can be achieved by a manager sending a digitally signed email (an email stamped by their personal digital certificate). Such an email, once checked and verified by the recipient, is a legally binding request for a service. Similarly, if a web-server has a restricted access area, the server can request a digital certificate from the user’s browser to identify the user and then determine if they should be given access to the information according to the server’s permission rules.
10.Integrity: Integrity of information means ensuring that a communication received has not been altered or tampered with. Traditionally, this problem has been dealt with by having tight control over access to paper documents and requiring authorized officers to initial all changes made – a system with obvious drawbacks and limitations. If someone is receiving sensitive information online, he not only wants to ensure that it is coming from who he expects it to (authentication), but also that it hasn’t been intercepted by a hacker while in transit and its contents altered. The speed and distances involved in online communications requires a very different approach to this problem from traditional methods. One solution is afforded by using digital certificates to digitally “sign” messages. A travelling employee can send production orders with integrity to the central office by using their digital certificate to sign their email. The signature includes a hash of the original message – a brief numerical representation of the message content. When the recipient opens the message, his email software will automatically create a new hash of the message and compare it against the one included in the digital signature. If even a single character has been altered in the message, the two hashes will differ and the software will alert the recipient that the email has been tampered with during transit.
11.Non-repudiation: Non-repudiation is the ability to guarantee that once someone has requested a service or approved an action, they cannot turn around and say “I didn’t do that!”. Non-repudiation allows one to legally prove that a person has sent a specific email or made a purchase approval from a website. Traditionally non-repudiation has been achieved by having parties sign contracts and then have the contracts notarized by trusted third parties. Sending documents involved the use of registered mail, and postmarks and signatures to date-stamp and record the process of transmission and acceptance. In the realm of e-commerce, nonrepudiation is achieved by using digital signatures. Digital signatures which have been issued by a trusted authority (such as VeriSign) cannot be forged and their validity can be checked with any major email or web browser software. A digital signature is only installed in the personal computer of its owner, who is usually required to provide a password to make use of the digital signature to encrypt or digitally sign their communications. If a company receives a purchase order via email which has been digitally signed, it has the same legal assurances as on receipt of a physical signed contract.
12.Security policy The first step in securing an e-commerce venture is to formulate written security policies (website 1) which clearly define the requirements for each component of the system (human, e-Commerce security – A life cycle approach 129 technological, legal) and how they interact. An organization’s security policy defines its position on the protection of its physical and IT assets. It identifies the physical and intellectual property assets that are most valuable for the continued success of the company, and specifies how they should be protected.
13. Security infrastructure
The security infrastructure (website 1) is the implementation of the security policy. The security infrastructure is the technology which is chosen to secure the e-business and the rules by which it operates. Some examples of this include:
- enforcing password aging and expiration
- enforcing the complexity of passwords
- blocking prohibited outbound connections from the firewall
- requiring digital certificates to authenticate remote access connections to an organization’s network
- requiring badges for physical access to building
- requiring all physical access to servers to be recorded in a written log Again, the security infrastructure entails managing the behavior of both IT and human resources. It should be regularly policed:
- Who checks written logs?
- How often are firewall reports checked? Finally, it must be enforced. The penalties for breaches of the security policy must be made clear to all employees and partners and must be enforced if policy requirements are broken or ignored.
14. Testing e-commerce security
The main objective of security testing, therefore, includes
- Verification of the security requirement specification such as location of the asset(s), access control mechanism for the assets, operational context of the organization, existing system services and their access control mechanisms, and the connectivity within the organization and connectivity of the organization to the outside world
- Verification of the configuration of the security tools specified in the security infrastructure i.e. whether the security tools are properly installed and configured to maintain the security of the asset
- Verification of any gap between the proposed security infrastructure and the implemented security infrastructure
- Verification of the limitation of the proposed security infrastructure with respect to the known vulnerabilities.
Titany answered the question on September 23, 2021 at 16:10