E-Commerce Security Systems: One Mark Questions, Book Back Answers and Notes

About E-Commerce Security Systems

Medium ~120 min study

An online shop sends card numbers, addresses and orders across the open internet. Anyone on the path can try to read that data, change it or pretend to be someone else. This unit explains what can go wrong and what stops it from going wrong.

The chapter moves in three steps. First it lists the threats: information leakage, tampering, payment fraud, malicious code, phishing, denial of service attacks and domain name misuse. Next it sets out the dimensions of security a safe transaction must meet, such as authenticity, integrity and non-repudiation. Last, it shows the technology that meets them: encryption, digital signatures, digital certificates and the SSL, SET and 3-D Secure protocols.

In the MCQs, expect to match a threat with its name (for example, typopiracy or friendly fraud), tell symmetric from asymmetric encryption, and pick which protocol was built for which job. SSL secures the connection; SET and 3-D Secure are about card payments.

What you'll learn

• Identify common e-commerce threats and name the type of malicious code or fraud in a given example
• State the dimensions of security and explain each with an example
• Distinguish between symmetric and asymmetric key encryption
• Explain what a digital signature and a digital certificate each prove
• Describe how SSL secures communication between a browser and a server
• Explain how SET and 3-D Secure protect card payments

Before you start

• Basic idea of computer networks and how the internet carries data
• E-commerce business models
• Electronic payment methods from Unit 16

E-Commerce Security Systems explained

E-Commerce Security at a Glance

Security Threats

Because the internet is open, online businesses face both accidental and deliberate attacks. Information leakage means trade secrets or transaction details reach an unauthorised person. Tampering means data is changed while it travels. Payment frauds include friendly fraud (a customer receives the goods and then falsely disputes the payment), clean fraud (a stolen card used with correct details so the purchase looks genuine) and triangulation fraud (a fake shop collects card details). Malicious code covers viruses, worms, ransomware and SQL injection. Phishing tricks users into giving away passwords and card details. A distributed denial of service attack floods a server with requests until it stops responding. Cyber squatting and typopiracy misuse domain names, the second by registering misspellings of popular site names.

Dimensions of Security

A secure transaction should meet these requirements. Authenticity: the parties are who they claim to be. Confidentiality: data is not disclosed to unauthorised people. Integrity: data is not altered. Availability: information is not delayed or removed. Non-repudiation: neither buyer nor seller can later deny taking part. Privacy: customers' personal data is protected. Review ability: operations can be audited later.

Encryption, Signatures and Certificates

Encryption turns readable plaintext into unreadable ciphertext. In symmetric key encryption the same secret key encrypts and decrypts. It is fast, but the key has to be shared safely with the other side, which is hard. In asymmetric key (public key) encryption each user has a pair of keys. Data encrypted with the receiver's public key can be opened only with the receiver's private key, which gives confidentiality. When the sender signs with their own private key and others check it with the sender's public key, you get authenticity and non-repudiation. A digital signature shows who sent a document and that it has not been changed. A digital certificate, issued by a Certification Authority (CA), links a public key to a named person or organisation.

Security Protocols

SSL (Secure Sockets Layer), developed by Netscape, uses hybrid encryption to create an encrypted channel between the browser and the web server. A site using it shows https:// and a padlock in the address bar. SET (Secure Electronic Transaction), developed by Visa and MasterCard, protects credit card payments using public key cryptography and dual signatures, so the merchant does not see the card details and the bank does not see the order details. 3-D Secure is an XML-based protocol that adds an authentication step, such as an OTP from the card issuer. Its three domains are the acquirer domain, the issuer domain and the interoperability domain.

Common mistakes to avoid

• Mixing up the two encryption types. Symmetric uses one shared key for both jobs. Asymmetric uses a public key and a different private key.
• Treating a digital signature and a digital certificate as the same thing. A signature is attached to a message and proves who sent it and that it was not changed. A certificate, issued by a CA, proves that a public key really belongs to that person or company.
• Assuming HTTPS makes the whole website safe. HTTPS protects data only while it travels. It does not stop SQL injection or an attack on the server's database.
• Thinking security is only about technology. Policies, staff and user awareness (for example, not falling for phishing) and legal rules matter too.

Test yourself on these with the practice test, then check the worked reasoning in the solved MCQs.

Frequently asked questions

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses the same secret key to encrypt and decrypt, so it is fast, but both sides must somehow share that key safely. Asymmetric encryption uses a key pair: data locked with a public key can only be opened with the matching private key. This removes the need to share a secret key over an open network.

How does SSL keep online shopping safe?

SSL sets up an encrypted connection between the buyer's browser and the shop's server. Card numbers, passwords and addresses travel as ciphertext, so anyone who intercepts them cannot read them. You can see SSL at work when the address starts with https:// and a padlock appears.

What are digital signatures used for?

A digital signature confirms two things: the message really came from the claimed sender, and it was not altered on the way. The sender signs with their private key, and the receiver checks the signature with the sender's public key. Because only the sender holds the private key, the sender also cannot deny sending it.

What is cyber squatting?

Cyber squatting is registering or using a domain name that contains someone else's well-known trademark, in bad faith. The squatter usually hopes to sell the domain to the real trademark owner at a high price. Typopiracy is a related trick that registers misspelt versions of popular domain names.

What does non-repudiation mean?

Non-repudiation means a party cannot deny an action they took. Once a buyer has signed and authorised a payment, or a seller has signed a confirmation, the digital signature is evidence that they did it. This matters when a dispute comes up later.

How does 3-D Secure work?

3-D Secure is an XML-based protocol that adds a check during online card payments. Before the payment is approved, the cardholder's bank asks the user to confirm their identity, usually with a password or OTP. The name comes from its three domains: acquirer, issuer and interoperability.