E-Commerce Security Systems Exercise Solutions | KalviGavani

Phishing is a cyber attack where an attacker sends fraudulent emails or creates fake websites that appear to be from a trusted source (banks, companies) to trick users into revealing sensitive information (passwords, credit card numbers, OTP).

Prevention:

• Do not click on suspicious links in emails or messages
• Verify the website URL before entering personal information (look for HTTPS and correct domain)
• Never share OTPs, PINs, or passwords via email or phone
• Use two-factor authentication (2FA) for additional security
• Check for spelling errors and generic greetings in emails (signs of phishing)
• Report suspicious emails to the concerned organisation

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks (like the internet).

Types:

• Hardware firewall — a separate physical device placed between the network and the internet; protects an entire network
• Software firewall — installed on individual computers; protects a single device

Encryption is the process of converting plain text data into an unreadable coded form (cipher text) using a cryptographic key, so that only authorised parties with the correct key can decrypt and read the data.

Types:

• Symmetric encryption — uses the same key for both encryption and decryption. Fast but requires secure key exchange. Example: AES.
• Asymmetric encryption — uses a public key for encryption and a private key for decryption. Slower but more secure for key exchange. Example: RSA.

A digital certificate is an electronic document issued by a Certifying Authority (CA) that verifies the identity of a website or individual and binds it to a public key.

Contents:

• Certificate holder's name/identity
• Public key of the holder
• Certificate serial number
• Validity period (start and expiry dates)
• Name of the issuing Certifying Authority (CA)
• Digital signature of the CA

Purpose: Ensures that the website or individual is legitimate and that data exchanged is encrypted and secure.

The Information Technology Act 2000 is India's primary legislation governing cyber crime, electronic commerce, and digital signatures. It was enacted to provide legal recognition to electronic records and transactions.

Key provisions:

• Legal recognition of electronic records and digital signatures
• Penalises cyber crimes: hacking (Section 66), publishing obscene information (Section 67), identity theft
• Establishes the Cyber Appellate Tribunal
• Provides for the appointment of the Controller of Certifying Authorities
• Amended by IT Act Amendment 2008 to include provisions on data protection, cyber terrorism, and privacy

• A malicious program that attaches itself to a legitimate file or program
• Requires user action (opening a file, running a program) to activate
• Can corrupt data, delete files, slow down the system, or display unwanted messages
• Spreads through infected files, USB drives, email attachments
• Examples: ILOVEYOU, Melissa, CIH (Chernobyl)

• A standalone malicious program that self-replicates and spreads through networks
• Does NOT need to attach to a file or require user action
• Consumes network bandwidth, slows down systems, can carry harmful payloads
• Spreads through network connections, email, and operating system vulnerabilities
• Examples: Code Red, Conficker, WannaCry (worm component)

• Disguised as legitimate or useful software to trick users into installing it
• Does NOT self-replicate
• Creates a backdoor for attackers to access the system remotely
• Can steal data, install additional malware, or take control of the system
• Examples: Zeus (banking trojan), Back Orifice, Emotet

• Secretly monitors user activity (browsing habits, keystrokes) and collects personal information
• Sends collected data to third parties without user knowledge or consent
• Can record passwords, credit card numbers, and browsing history
• Often bundled with free software downloads
• Examples: Keyloggers, browser hijackers, tracking cookies

• Automatically displays unwanted advertisements (pop-ups, banners) on the user's screen
• May track browsing habits to show targeted ads
• Not always malicious but can be annoying and invade privacy
• Often bundled with free software

• Fraudulent attempt to obtain sensitive information by posing as a trustworthy entity
• Uses fake emails, messages, or websites that look like legitimate ones
• Targets passwords, credit card numbers, OTPs, and personal data
• Types: email phishing, spear phishing (targeted), smishing (SMS phishing), vishing (voice phishing)

• Unauthorised access to a computer system or network
• Hackers exploit vulnerabilities in software, weak passwords, or social engineering
• Can result in data theft, system damage, or financial loss
• Types: white hat (ethical), black hat (malicious), grey hat (neither)

• Encrypts the victim's files and demands a ransom (usually in cryptocurrency) for the decryption key
• Can spread through phishing emails, malicious downloads, or network vulnerabilities
• Examples: WannaCry, Petya, CryptoLocker

Firewall: A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on security rules. It acts as a gatekeeper between a trusted internal network and untrusted external networks.

• Hardware firewall — a physical device placed between the network and the internet; protects the entire network
• Software firewall — installed on individual computers; protects a single device

Functions:

• Blocks unauthorised access attempts
• Filters traffic based on IP addresses, ports, and protocols
• Prevents malware from entering the network
• Logs network activity for monitoring

Antivirus Software: Antivirus is a program that detects, prevents, and removes malicious software (viruses, worms, trojans, spyware, adware).

Functions:

• Scans files and programs for known malware signatures
• Monitors system behaviour for suspicious activity (heuristic analysis)
• Quarantines or deletes infected files
• Provides real-time protection by scanning downloads and email attachments
• Regular updates to protect against new threats

Examples: Norton, McAfee, Kaspersky, Avast, Windows Defender

Encryption: Encryption converts plain text data into an unreadable coded form (cipher text) using a cryptographic key, ensuring that only authorised parties with the decryption key can read the data.

Types:

• Symmetric encryption — same key for encryption and decryption (e.g., AES). Fast but requires secure key exchange.
• Asymmetric encryption — uses a public key for encryption and a private key for decryption (e.g., RSA). More secure for key exchange.

Role in e-commerce:

• SSL/TLS encrypts data between browser and server (HTTPS)
• Protects credit card numbers, passwords, and personal data during transmission
• Ensures data integrity and confidentiality

The Information Technology Act 2000 is India's primary legislation governing electronic commerce, digital signatures, and cyber crime. It was enacted on 17 October 2000 and amended in 2008.

Key Provisions:

Other Key Features:

• Legal recognition of electronic records and digital signatures
• Establishment of Cyber Appellate Tribunal
• Appointment of Controller of Certifying Authorities (CCA)
• Provides framework for e-governance and e-commerce
• IT Act Amendment 2008 added provisions on data protection (Section 43A), cyber terrorism (Section 66F), and child pornography (Section 67B)

A digital certificate is an electronic document issued by a trusted Certifying Authority (CA) that verifies the identity of a website, organisation, or individual and binds it to a public key.

Contents of a digital certificate:

• Certificate holder's name and identity information
• Public key of the holder
• Certificate serial number
• Validity period (issue date and expiry date)
• Digital signature of the issuing Certifying Authority (CA)
• CA's name and contact information

Role in e-commerce security: 1. Authentication — verifies that the website or individual is who they claim to be 2. Encryption — the public key in the certificate enables SSL/TLS encryption between browser and server 3. Integrity — ensures data has not been tampered with during transmission 4. Trust — browsers display a padlock icon and HTTPS for websites with valid certificates, building user confidence

How it works in e-commerce: 1. When a user visits an e-commerce website, the browser checks the site's digital certificate 2. The browser verifies the certificate with the issuing CA 3. If valid, the browser establishes an encrypted SSL/TLS connection 4. All data exchanged (card numbers, passwords) is encrypted and secure

Types of digital certificates:

• DV (Domain Validated) — basic validation; only confirms domain ownership
• OV (Organisation Validated) — verifies the organisation's identity
• EV (Extended Validation) — highest level; requires rigorous identity verification; displays green bar in browser

How firewalls protect e-commerce systems: 1. Block unauthorised access — prevent hackers from entering the network 2. Filter traffic — allow only legitimate traffic based on IP, port, and protocol rules 3. Prevent DDoS attacks — block excessive traffic from overwhelming the server 4. Monitor network activity — log traffic for auditing and intrusion detection 5. Enforce security policies — restrict access to sensitive areas of the e-commerce system

A robust e-commerce security setup typically uses both: a hardware firewall at the network perimeter and software firewalls on individual servers and devices for layered protection.