21 Apr 2009

Exercise 17: Concurrency terms

Find definitions for eight terms and concepts used in threaded programming:

1. Thread Synchronisation
2. Locks
3. Deadlock
4. Semaphores
5. Mutex (mutual exclusion)
6. Thread
7. Event
8. Waitable timer


Answer:

1. Selvam (2004) shows the definition of Thread Synchronisation. That is, in a multithreaded environment, each thread has its own local thread stack and registers. If multiple threads access the same resource for read and write, the value may not be the correct value. For example, let's say our application contains two threads, one thread for reading content from the file and another thread writing the content to the file. If the write thread tries to write and the read thread tries to read the same data, the data might become corrupted. In this situation, we want to lock the file access. The thread synchronization has two stages. Signaled and non-signaled.
The signaled state allows objects to access and modify data. The non-signaled state does allow accessing or modifying the data in the thread local stack.
Many of the thread synchronization methods are used to synchronize multiple threads.

2. Wang (2001) states that there are 2 types of Locks. a read/write lock manager allows a server to manage its data resource for client read and write requests. Let's review the difference between a read lock, and a write lock. The following table lists the different locking levels, and the compatibilities between each locking levels.
Table-1 - The Lock Compatibility extracted from http://www.concentric.net/~Ttwang/tech/rwlock.htm

A read lock is required before reading on a data item. A write lock is required before writing on a data item. Multiple parties can read on a data item with no problem. This is indicated in the table by looking at the intersection of requested lock (read), and already granted lock (read also). We should find the 'yes' compatibility label in the intersection. On the other hand, one cannot write on a data item while there are still readers out there. Similarly, one cannot read on a data item while there is a writer out there. For practice, look up these two statements in the compatibility table. Any client that want to access a data item should first obtain a read lock, then after the data item is read, release the lock. Any client that want to write a data item should first obtain a write lock, then after the data item is written, release the lock. (Wang, 2001)

3. Wikipedia (2009) describes that a Deadlock is a situation wherein two or more competing actions are waiting for the other to finish, and thus neither ever does. It is often seen in a paradox like "the chicken or the egg". "When two trains approach each other at a crossing, both shall come to a full stop and neither shall start up again until the other has gone." - Illogical statute passed by the Kansas Legislature.
In computer science, deadlock refers to a specific condition when two or more processes are each waiting for each other to release a resource, or more than two processes are waiting for resources in a circular chain (see Necessary conditions). Deadlock is a common problem in multiprocessing where many processes share a specific type of mutually exclusive resource known as a software, or soft, lock. Computers intended for the time-sharing and/or real-time markets are often equipped with a hardware lock (or hard lock) which guarantees exclusive access to processes, forcing serialization. Deadlocks are particularly troubling because there is no general solution to avoid (soft) deadlocks.
This situation may be likened to two people who are drawing diagrams, with only one pencil and one ruler between them. If one person takes the pencil and the other takes the ruler, a deadlock occurs when the person with the pencil needs the ruler and the person with the ruler needs the pencil to finish his work with the ruler. Both requests can't be satisfied, so a deadlock occurs.
The telecommunications description of deadlock is a little stronger: deadlock occurs when none of the processes meet the condition to move to another state (as described in the process's finite state machine) and all the communication channels are empty. The second condition is often left out on other systems but is important in the telecommunication context.

4. Selvam (2004) shows that Semaphore is used to synchronize between objects. Semaphore is a thread synchronization object that allows zero to any number of threads access simultaneously.

5. Webopedia (2009) points out that Mutex is short for Mutual Exclusion object. In computer programming, a mutex is a program object that allows multiple program threads to share the same resource, such as file access, but not simultaneously. When a program is started, a mutex is created with a unique name. After this stage, any thread that needs the resource must lock the mutex from other threads while it is using the resource. The mutex is set to unlock when the data is no longer needed or the routine is finished.

6. Whatis.com (2009) states that in computer programming, a Thread is placeholder information associated with a single use of a program that can handle multiple concurrent users. From the program's point-of-view, a thread is the information needed to serve one individual user or a particular service request. If multiple users are using the program or concurrent requests from other programs occur, a thread is created and maintained for each of them. The thread allows a program to know which user is being served as the program alternately gets re-entered on behalf of different users. (One way thread information is kept by storing it in a special data area and putting the address of that data area in a register. The operating system always saves the contents of the register when the program is interrupted and restores it when it gives the program control again.)
A thread and a task are similar and are often confused. Most computers can only execute one program instruction at a time, but because they operate so fast, they appear to run many programs and serve many users simultaneously. The computer operating system gives each program a "turn" at running, then requires it to wait while another program gets a turn. Each of these programs is viewed by the operating system as a task for which certain resources are identified and kept track of. The operating system manages each application program in your PC system (spreadsheet, word processor, Web browser) as a separate task and lets you look at and control items on a task list. If the program initiates an I/O request, such as reading a file or writing to a printer, it creates a thread. The data kept as part of a thread allows a program to be reentered at the right place when the I/O operation completes. Meanwhile, other concurrent uses of the program are maintained on other threads. Most of today's operating systems provide support for both multitasking and multithreading. They also allow multithreading within program processes so that the system is saved the overhead of creating a new process for each thread.

7. Selvam (2004) shows that Event is used to synchronize between objects. Event is a thread synchronization object used to set the signaled or non-signaled state. The signaled state may be manual or automatic depending on the event declaration.

8. MSDN (2009) describes that a Waitable Timer object is a synchronization object whose state is set to signaled when the specified due time arrives. There are two types of waitable timers that can be created: manual-reset and synchronization. A timer of either type can also be a periodic timer.
Manual-reset timer - A timer whose state remains signaled until SetWaitableTimer is called to establish a new due time.
Synchronization timer - A timer whose state remains signaled until a thread completes a wait operation on the timer object.
Periodic timer - A timer that is reactivated each time the specified period expires, until the timer is reset or canceled. A periodic timer is either a periodic manual-reset timer or a periodic synchronization timer.
  1. The behavior of a waitable timer can be summarized as follows:
    When a timer is set, it is canceled if it was already active, the state of the timer is nonsignaled, and the timer is placed in the kernel timer queue.
  2. When a timer expires, the timer is set to the signaled state. If the timer has a completion routine, it is queued to the thread that set the timer. The completion routine remains in the asynchronous procedure call (APC) queue of the thread until the thread enters an alertable wait state. At that time, the APC is dispatched and the completion routine is called. If the timer is periodic, it is placed back in the kernel timer queue.
  3. When a timer is canceled, it is removed from the kernel timer queue if it was pending. If the timer had expired and there is still an APC queued to the thread that set the timer, the APC is removed from the thread's APC queue. The signaled state of the timer is not affected.
Reference:

1. Selvam R. (2004). "CodeProject: Thread Synchronization for Beginners". The Code Project Your Development Resource, Retrieved from URL - http://www.codeproject.com/KB/threads/Synchronization.aspx
2. Wang Thomas (2001). "Java Thread Programming: Implement Read & Write Locks". Thomas Wang's Home Page, Retrieved from URL - http://www.concentric.net/~Ttwang/tech/rwlock.htm
3. Wikipedia (2009). "Deadlock". Wikipedia The Free Encylopedia, Retrieved from URL -
http://en.wikipedia.org/wiki/Deadlock
4. Webopedia (2009). "What is Mutex?". The #1 Online Encyclopedia dedicated to computer technology, Retrieved from URL -
http://www.webopedia.com/TERM/m/mutex.html
5. Whatis.com (2009). "What is Thread?". TechTarget Corporate Web Site, Retrieved from URL -
http://searchcio-midmarket.techtarget.com/sDefinition/0,,sid183_gci213139,00.html
6. MSDN (2009). "Waitable Timer Objects (Windows)." MSDN Microsoft Developer Network, Retrieved from URL -
http://msdn.microsoft.com/en-us/library/ms687012(VS.85).aspx







Q6. The use of digital certificates and passports are just 2 examples of many tools for validating legitimate users & avoiding...

Q6. The use of digital certificates and passports are just 2 examples of many tools for validating legitimate users & avoiding consequences such as identity theft. What others exist?

Answer:

Digital Certificates (or sometimes called Digital IDs) are the electronic counterparts to driver licenses or identity cards. You can present a digital certificate electronically to prove your identity in an electronic message or your right to access information or services available online on the Internet.
The most common use of a digital certificate is to verify that a user sending an electronic mail message is who he or she claims to be, or authenticating a World Wide Web services without the need of user name and password. In the electronic commerce area, a new emerging standard SET (Secure Electronic Transaction) co-developed by Visa and MasterCard, which safeguards credit card purchases made over open network such as Internet, is also based on the digital certificate technology. (CCST, 1997)

Digital Passport were introduced in Germany since 2005. According to Germany's Ministry of the Interior, some 600,000 Germans have applied for these new passports. In the initial version, these biometric passports contain a picture of the passport holder stored on a chip. When this chip is contacted via wireless, it only sends the data it has (the facial picture and a digital signature) if the access key provided in the query is correct. In 2007 or afterwards, fingerprints may be added to these facial pictures. This second version of the biometric passports requires a complex infrastructure because fingerprint scans require an online check to see whether the digital signature is valid. Starting in April of this year, all passport centers will also be receiving digital passport scanners so that citizens can see what is stored on the chip. (Craig Morris) (CeBIT, 2006)

Beside Digital Certificates and Passports, there are also other tools for validating legitimate users and avoiding consequences such as identity theft. The tools are Digital Signature, Electronic ID and Digital Fingerprint.

A digital signature or digital signature scheme is a type of asymmetric cryptography. For messages sent through an insecure channel, a properly implemented digital signature gives the receiver reason to believe the message was sent by the claimed sender. Digital signatures are equivalent to traditional handwritten signatures in many respects; properly implemented digital signatures are more difficult to forge than the handwritten type. Digital signature schemes in the sense used here are cryptographically based, and must be implemented properly to be effective. Digital signatures can also provide non-repudiation, meaning that the signer cannot successfully claim they did not sign a message, while also claiming their private key remains secret; further, some non-repudiation schemes offer a time stamp for the digital signature, so that even if the private key is exposed, the signature is valid nonetheless. Digitally signed messages may be anything representable as a bitstring: examples include electronic mail, contracts, or a message sent via some other cryptographic protocol. (Wikipedia-1, 2009)

An e-ID (short for Electronic Identification) and its corresponding password is your means of identifying yourself to the various services available at SIUE. If you apply for an e-ID using the following web pages and meet all the criteria, you will be assigned an e-ID and password.
An e-ID will give you access to may services provided at SIUE. For example:
  • Access to Blackboard
  • Dial-up access to the internet from a home PC
  • Email
  • Personal Web pages
  • Advisor Track
(Blackboard, 2009)

A digital fingerprint is an identifying sequence of digits which is the result of applying a mathematical algorithm to the complete content of a digital file. Digiprove uses a proven algorithm called "SHA256" for this. The process generates a 256-bit (64 character) calculated value, and the algorithm is so constructed that even the tiniest change to a document will result in a change to its fingerprint. The algorithm is a "one-way" process which means that it is not possible to recreate a document from the fingerprint, and that it is not possible (without massive computing power factors beyond those currently available) for a computer program to calculate a document that will result in a given fingerprint. (DIGIPROVE, 2009)

Reference:

1. CCST (1997). "Digital Certificates". Centre of Computing Services and Telecommunications in the Hong Kong University of Science & Technology, Retrieved from URL - http://www.ust.hk/itsc/internet/digitalid/
2. CeBIT (2006). "FDP wants to postpone biometric passports". CeBIT 2-6 March 2010, Retrieved from URL - http://www.cebit.de/newsanzeige_e.html?multi=1&back=/homepage_e&news=22752&back=%2Fhomepage_e&PHPSESSID=c0a80e37af2ffb4fff2065059d432a74e576e5f3&x=1
3. Wikipedia-1 (2009). "Digital Signature". Wikipedia The Free Encyclopedia, Retrieved from URL - http://en.wikipedia.org/wiki/Digital_Signature
4. Blackboard (2009). "Electronic ID (E-ID)". Information Technology Services in SIUE Edwardsville, Retrieved from URL - http://www.siue.edu/its/ftc/bb/ and http://www.siue.edu/its/ftc/bb/pdf/new_e_ID.pdf
5. DIGIPROVE (2009). "What is Digital Fingerprint?". FAQ - Frequently Asked Questions - DIGIPROVE Proving Ownership & Compliance, Retrieved from URL - http://www.digiprove.com/faq_what_is_digital_fingerprint.aspx





Q5. Get the latest PGP software from...

Q5. Get the latest PGP software from http://web.mit.edu/network/pgp.html; install it on 2 machines and encrypt a message on one machine and decrypt it on the other. Report your findings.

Answer:

I have tried to download the PGP software from http://web.mit.edu/network/pgp.html. However, the website shows "MIT No Longer Distributes PGP". See Diagram-75 - Unable to get PGP from MIT. After that, I have downloaded freeware PGP from http://www.pgpi.org/products/pgp/versions/freeware/ and test the PGP software. The PGP I found is not suitable to simply encrypt and decrypt message. Therefore, this question cannot be answered unless the correct PGP software is offered.

Diagram-75 - PGP software is not available in MIT


Q4. Visit the TRUSTe web site. Describe what services and solutions are offered.

Answer:

TRUSTe helps consumers and businesses identify trustworthy online organizations through its Web Privacy Seal, Email Privacy Seal and Trusted Download Programs. TRUSTe resolves thousands of individual privacy disputes every year.
TRUSTe has earned a reputation as the leader in promoting privacy policy disclosure, informed user consent, and consumer education.
The TRUSTe privacy program – based on a branded online seal, the TRUSTe "trustmark" – bridges the gap between users' concerns over privacy and Web sites' needs for self-regulated information disclosure standards. (TRUSTe, 2009)

TRUSTe's services support online business growth by allowing companies to communicate their commitment to privacy, and letting consumers know which businesses they can trust.

In detail, TrustE help customers to build seals as services and solutions in order to protect privacy. They are namely, Web Privacy Seal, EU Safe Harbor Seal, Email Privacy Seal, International Services, Children's Privacy Seal, Japan Privacy Seal and Trusted Download Program.

Reference:

1. TRUSTe (2009). "TRUSTe - Enterprise Privacy Solutions". TRUSTe, Retrieved from URL - http://www.truste.org/businesses/enterprise.php





Q3. Visit the Verisign web site - what solutions does it offer for e-commerce?

Answer:

VeriSign offers the solutions for e-commerce. The solutions are follow...
  • VeriSign Identity Protection - Easy-to-use authentication and transparent fraud detection from a trusted provider protects online transactions without slowing transactions - offers Customer Protection
  • SSL Certificates, and Secure Site Pro with EV SSL Certificates - Give your customers the confidence to transact online by displaying the green address bar in the latest high-security browser with Extended Validation SSL on your Web site - offers WebSite Security
  • Managed Security Services, Unified Authentication, and Managed PKI Services - Authentication solutions for the enterprise, Web applications, and e-mail combined with comprehensive network protection help reduce risk while meeting compliance requirements - offers Network Security
  • Global Consulting Services, and VeriSign iDefense Security Intelligence Services - Security consulting and advanced intelligence reporting help you assess, analyze and update a layered approach to secure business assets - offers Expert Assistance and Intelligence
  • VeriSign Identity Protection - Large retailers and suppliers need to open their networks to partners, affiliates, and customers to enhance services and speed operations while keeping confidential data secure - offers Supply Chain Visibility
(VeriSign, 2009)

Reference:

1. VeriSign (2009). "E-Commerce Security - SSL Certificates". VeriSign, Retrieved from URL - http://www.verisign.com/verisign-business-solutions/commerce-enablement-solutions/index.html

Q2. What measures should e-commerce provide to create trust among their potential customers? What measures can be verified by the customer?

Answer:

Rico (2009) suggests eTailQ and Agile methods to measure how e-commerce to create trust among potential customers. E-commerce should provide the measurement as ...
  • Fulfillment and Reliability
  • Privacy and Security
Fulfillment and Reliability have 3 factors. They are Order Received, On Time Delivery and Order Accurate. Order Received means you get what you ordered from this site. On Time Delivery means the product is delivered by the time promised by the company. Order Accurate means the product that came was represented accurately by the website.
Privacy and Security have 3 factors. They are Protection of Privacy, Feelings of Safety and Adequate Security. Protection of Privacy means I feel like my privacy is protected at this site. Feelings of Safety means I feel safe in my transactions with this website. Adequate Security means the website has adequate security features.

Through fulfillment & reliability and privacy and security, e-commerce can create trust among their potential customers.

The customer can verify the above measurement with feedback to the website. In Agile, there is Early Customer Involvement. The Early Customer Involvement has 5 items. They are Feedback Solicited - We seek early market feedback on every software release, Feedback Received - We receive early market feedback on every software release, Feedback Frequency - We receive early market feedback within a few hours or days, Feedback Quality - We receive in-depth early market feedback on every software release, and Feedback Incorporated - We incorporate early market feedback into every software release.
(Rico, 2009)

With Customers' Feedback, the measures can be verified.

Reference:

1. Rico David F (2009). "DO AGILE METHODS RESULT IN HIGHER QUALITY WEBSITES?". Let Me Energize Your Software Process Improvement, Retrieved from URL - http://davidfrico.com/rico07e.pdf




Q1. Visit an e-commerce website & survey the mode of payment allowed. Would you trust the site with your business?

Exercise 16: Authentication and Encryption Systems

Q1. Visit an e-commerce website & survey the mode of payment allowed. Would you trust the site with your business?


Answer:

I have visited the online supermarket at http://www.juscocityhk.com/b5/content.jsp and have surveyed the mode of payment allowed. The modes of payment found in the website are to
  • Cash On Delivery
  • Credit Card - VISA
  • Credit Card - MasterCard
  • Credit Card - AMERICAN EXPRESS
  • Credit Card - Diners Club International
  • Credit Card - JCB
  • Credit Card - AEON
The Diagram-70 below shows the modes of payment.
Diagram-70 - The Modes of Payment in http://www.juscocityhk.com/b5/content.jsp

Yes, I trust this website with my business because this website is secure enough to protect privacy and security. For examples, the following screen dumps in Diagram-71 show encrypted username & password authentication and 128-bits SSL encryption transmission over Internet.
Diagram-71 - Authentication and 128-bits SSL Encryption

Q3. Most of the antivirus software...

Q3. Most of the Anti-Virus software perform an active scanning of the user activity on the Internet, detecting downloads and attachments in emails. Hackers have readily available resources to create new viruses. How easy is it to find a virus writing kit? Search the Internet and find such a tool. For example, see what you can find at http://vx.netlux.org/dat/vct.shtml.

Answer:

It is very easy to find the virus writing kit. Seeing the diagram-80 below, I simply type "download virus creation tools" in Google. It shows over 200 related sites.
Diagram-80 - The Google Search Result



When click on the provided link, I find the result listed in the Diagram-81.


Diagram-81 - The virus creation tools found

I can find a virus creation tool called "blue-screen of dead". It makes windows computer blue screen. (See Diagram-82 for detail)


Digram-82 - Blue Screen of Dead Virus
I can downlod it and play. However, it is illegal so I will not do it.








Q2. Find out if your university or workplace has a backup policy in place. Is it followed and enforced?

Answer:

There is a backup policy in my workplace. The backup policy is ...
1. All employees need to optionally or weekly backup the personal data from local PC to the share drive Z: of the file server.
2. All employees have to clone the entire local PC's hard drives to the Norton Ghost Server per 1 month.

The above backup policy is enforced.




Q1. What makes a firewall a good security investment? Accessing Internet, find 2 or 3 firewall vendors. Do they provide hardware, software or both?

Exercise 15: Protecting and Archiving Data

Answer:

What makes a firewall a good security investment?
Vijayrajesh (2007) points out that if a computer is connected to the internet and it is not protected in some way, then it is vulnerable to attacks by external hackers. These attacks can be quite harmful to the PC and can even result in losing valuable data saved on the hard drive. A firewall is what protects your system from outside attacks and intrusions. There are many hackers actively trying to access computers for devious purposes. This unwanted traffic and visitor can steal data and also use your computer for their criminal plans, such as sending out junk emails. A firewall regulates this traffic to different zones, such as the internet or internal networks of which each has a different level of trust.

Personally, I feel firewall is used to protect valuable data from hacker and malware. Without firewall, the valuable data may be stolen or destoryed. The main point is to protect data as data is the most valuable thing. In order to protect the most valuable thing, firewall is a good security investment.

The three firewall vendors are...
Juniper Networks - The products are Netscreen-5200 and Netscreen-5400. Juniper Networks provides mainly hardware firewall.
Watchguard - The products are Fireware XTM and Firebox X-Edge e-series. Watchguard mainly makes hardware firewall.
Checkpoint - The products are Power-1 11000 Series and Software Blades where Checkpoint offers BOTH hardware and software respectively.

Reference:

1. Vijayrajesh (2007). "Useful Software, Internet and Websites Pedia". Vijayrajesh, Retrieved from URL - http://vrtechlog.blogspot.com/2007/11/why-you-need-firewall-and-how-zonealarm.html


Q2. Can the use of cookies be a security risk?

Answer:

Yes, because there are malicious cookie. Webopedia (2009) says that Cookies normally do not compromise security, but there is a growing trend of malicious cookies. These types of cookies can be used to store and track your activity online. Cookies that watch your online activity are called malicious or tracking cookies. These are the bad cookies to watch for, because they track you and your surfing habits, over time, to build a profile of your interests. Once that profile contains enough information there is a good chance that your information can be sold to an advertising company who then uses this profile information to target you with interest specific adverts. Many antivirus programs today will flag suspicious spyware or adware cookies when scanning your system for viruses.

Reference:

1. Webopedia (2009). "What You Need to Know About Cookies?". Webopedia The #1 Online Encyclopedia dedicated to computer technology, Retrieved from URL - http://www.webopedia.com/DidYouKnow/Internet/2007/all_about_cookies.asp



Q1. What are cookies and how are they used to improve security?

Exercise 14: Electronic payments and security II

Q1. What are cookies and how are they used to improve security?

Answer:


Webopedia (2009) describes cookies are the message given to a Web browser by a Web server. The browser stores the message in a text file. The message is then sent back to the server each time the browser requests a page from the server.
The main purpose of cookies is to identify users and possibly prepare customized Web pages for them. When you enter a Web site using cookies, you may be asked to fill out a form providing such information as your name and interests. This information is packaged into a cookie and sent to your Web browser which stores it for later use. The next time you go to the same Web site, your browser will send the cookie to the Web server. The server can use this information to present you with custom Web pages. So, for example, instead of seeing just a generic welcome page you might see a welcome page with your name on it.

How are they used to improve security?
Wikipedia (2009) states that the web server can specify the secure flag while setting a cookie; the browser will then send it only over a secure channel, such as an SSL connection. Moreover, the web page - http://www.jguru.com/faq/view.jsp?EID=425611 shows the example on how to make cookies secure. The example is listed below...
'secure' per RFC2109 as in...
//snip
Set-Cookie:JSESSIONID:893ihewwydkq2764@&@09;Path=/;secure
//snip
Marking the cookies this way ensures they cannot be delivered over an unencrypted session such as http.
Using these three methods together makes a cookie reasonably 'SECURE'

Reference:

1. Webopedia (2009). "What is cookie?". Webopedia The #1 Online Encyclopedia dedicated to computer technology, Retrieved from URL - http://www.webopedia.com/TERM/c/cookie.html
2. Wikipedia (2009). "Http cookie". Wikipedia The Free Encyclopedia, Retrieved from URL - http://en.wikipedia.org/wiki/HTTP_cookie







Q2. What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?

Answer:

What is SET?
Visa and MasterCard have jointly developed the Secure Electronic Transaction (SET) protocol as a method for secure, cost effective bankcard transactions over open networks. SET includes protocols for purchasing goods and services electronically, requesting authorization of payment, and requesting ``credentials'' (that is, certificates) binding public keys to identities, among other services. Once SET is fully adopted, the necessary confidence in secure electronic transactions will be in place, allowing merchants and customers to partake in electronic commerce.
SET supports DES for bulk data encryption and RSA for signatures and public-key encryption of data encryption keys and bankcard numbers. The RSA public-key encryption employs Optimal Asymmetric Encryption Padding.
SET is being published as open specifications for the industry, which may be used by software vendors to develop applications. (RSA.com, 2009)

How does SET compare to SSL as a platform for secure electronic transaction?
"Netscape's Secure Sockets Layer, SSL, provides a secure channel between web clients and web servers ... this is an important point because unlike the standard Internet protocols, such as TCP/IP, SSL must be selectively employed by the web client (the person surfing)... SSL is a layered approach to providing a secure channel" - Richardson quotes from page 103 of Gnosh
(Richardson, 2001)

SET - Secure Electronic Transaction, in SET protocol there are 4 entities
  • Cardholder
  • Merchant
  • Certificate Authority
  • Payment gateway - "the role of the payment gateway is to connect the Internet and proprietary networks of banks"
"SET protocol was developed jointly by Mastercard and Visa with the goal of providing a secure payment environment for the transmission of credit card data" - Richardson quotes from page 295 of Greenstein (Richardson, 2001)

According to Greenstein and Feinman (p. 297) "The initial version of SET protocol is considered to be a stronger security mechanism than other transmission protocols, such as SSL, because of SET's stronger authentification features". Greenstein and Feinman point out that SSL is good at providing confidentiality during the transmission of the data, but alone it does not authenticate either the sender or the receiver of the message. (Richardson, 2001)

Therefore, SSL is the way or protocol to transmit data in the secure channel but it does not offer authenication. SET is used mainly for secure authenication in transaction on the Internet (E-commerce)

Is SET in common use?
Yes, becuase SET is invented by VISA and MasterCard bodies in 1997, the transaction involving VISA & MasterCard will use SET.

Reference:

1. RSA.com (2009). "RSA Laboratories - 4.2.3 What is SET?". RSA Security, Retrieved from URL - http://www.rsa.com/rsalabs/node.asp?id=2287
2. Richardson W. Tim G. (2001). "MGTC50 - Section D". University of Toronto at Scarborough, Retrieved from URL -
http://www.witiger.com/ecommerce/outlineMGTC50d.htm#SETSSL



Q1. List and Describe your experiences with a secure Web site...

Exercise 13: Electronic payments and security I

Q1. List and describe your experiences with a secure Web site. Some examples may be:

  • University enrollment;
  • Online banking, auctions, real estate;
  • Booking a cheap air ticket or convert ticket;
  • Shopping online for a book, software or a CD.
Answer:

I have experience in the secure web sites. They are...
  1. Managing my bank accounts through I-banking at http://www.chbank.com/en/index.shtml
  2. Buying cinema ticket with my VISA card at https://www3.cinema.com.hk/revamp/html/order_fillin.php?lang=e&show_id=16066407&seatList=J12,J11
When handling my bank accounts, I need to click on the "logon" icon at http://www.chbank.com/en/index.shtml. After that, the Logon Window pops up. This pop-up window is displayed in Diagram-60.

Diagram-60 - Logon Window@ibanking

Then I need to enter my userid and password for authentication. When the authentication passes, I can manage my bank accounts, for example, I can transfer money from account A to account B, pay for bills or check my credit limits.

In http://www.chbank.com/en/index.shtml, I can find the security issue is concerned. For example, when I click on "Online Security Tips" button in Logon Window, I find that ...

  • the bank adopts the 128-bit Secure Socket Layer (SSL) encryption to assure the confidentiality of your personal and transaction data during transmission on the Internet.
  • the bank provides two-factor authentication tools to enhance the identity verification when you need to conduct online transactions.
When I buy film ticket at https://www3.cinema.com.hk/revamp/html/order_fillin.php?lang=e&show_id=16066407&seatList=J12,J11, I need to login first. Then I need to select the desirable seats and click on the "confirm" button. Once the confirm button has been clicked, I need to fill in my VISA card information to confirm the payment (through VISA or Master Cards). The following Diagram-61 shows the screen of ordering information...

Diagram-61 - buying film ticket

In the diagram-61, we can find that the web site is secured, for example, it is secured by "Verify by VISA" or MasterCard Secure Code". It is SET providing authentication and secure data transmission.






Q3. What is 'phishing'?

Answer:

In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT Administrators are commonly used to lure the unsuspecting. Phishing is typically carried out by e-mail or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Even when using server authentication, it may require tremendous skill to detect that the website is fake. Phishing is an example of social engineering techniques used to fool users, and exploits the poor usability of current web security technologies. Attempts to deal with the growing number of reported phishing incidents include legislation, user training, public awareness, and technical security measures.
A phishing technique was described in detail in 1987, and the first recorded use of the term "phishing" was made in 1996. The term is a variant of fishing, probably influenced by phreaking, and alludes to baits used to "catch" financial information and passwords. (Wikipedia, 2009)

The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information. (Webopedia, 2009)

Reference:

1. Wikipedia (2009). "Phishing". Wikipedia The Free Encyclopedia, Retrieved from URL - http://en.wikipedia.org/wiki/Phishing
2. Webopedia (2009). "What is Phishing?". The #1 Online Encyclopedia dedicated to computer technology, Retrieved from URL - http://www.webopedia.com/TERM/p/phishing.html




Q2. What can you find out about network and host-based intrusion detection systems?

Answer:

A network intrusion detection system (INDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic.
The NIDS does this by reading all the incoming packets and trying to find suspicious patterns. If, for example, a large number of TCP connection requests to a very large number of different ports are observed, one could assume that there is someone conducting a port scan of some or all of the computer(s) in the network. It also (mostly) tries to detect incoming shellcodes in the same manner that an ordinary intrusion detection systems does.
A NIDS is not limited to inspecting incoming network traffic only. Often valuable information about an ongoing intrusion can be learned from outgoing or local traffic as well. Some attacks might even be staged from the inside of the monitored network or network segment, and are therefore not regarded as incoming traffic at all.
Often, network intrusion detection systems work with other systems as well. They can for example update some firewalls' blacklist with the IP addresses of computers used by (suspected) crackers.
Certain DISA documentation, such as the Network STIG, uses the term NID to distinguish an internal IDS instance from its outward-facing counterpart. (Wikipedia-1, 2009)

A host-based intrusion detection system (HIDS) is an intrusion detection system that monitors and analyzes the internals of a computing system rather than on its external interfaces (as a network-based intrusion detection system (NIDS) would do).
A host-based IDS monitors all or parts of the dynamic behaviour and the state of a computer system. Much as a NIDS will dynamically inspect network packets, a HIDS might detect which program accesses what resources and discover that, for example, a word-processor has suddenly and inexplicably started modifying the system password-database. Similarly a HIDS might look at the state of a system, its stored information, whether in RAM, in the file-system, log files or elsewhere; and check that the contents of these appear as expected.
One can think of a HIDS as an agent that monitors whether anything/anyone - internal or external - has circumvented the security policy that the operating system tries to enforce. (Wikipedia-2, 2009)

Reference:

1. Wikipedia-1 (2009). "Network Intrusion Detection System". Wikipedia The Free Encyclopedia, Retrieved from URL - http://en.wikipedia.org/wiki/Network_intrusion_detection_system
2. Wikipedia-2 (2009) "Host-Based Intrusion Detection System". Wikipedia The Free Encyclopedia, Retrieved from URL - http://en.wikipedia.org/wiki/Host-based_intrusion_detection_system



Q1. Find out about SET and the use of RSA 128-bit encryption for e-commerce.

Exercise 12: Designing for a secure framework

Q1. Find out about SET and the use of RSA 128-bit encryption for e-commerce.

Answer:

Visa and MasterCard have jointly developed the Secure Electronic Transaction (SET) protocol as a method for secure, cost effective bankcard transactions over open networks. SET includes protocols for purchasing goods and services electronically, requesting authorization of payment, and requesting ``credentials'' (that is, certificates) binding public keys to identities, among other services. Once SET is fully adopted, the necessary confidence in secure electronic transactions will be in place, allowing merchants and customers to partake in electronic commerce.
SET supports DES for bulk data encryption and RSA for signatures and public-key encryption of data encryption keys and bankcard numbers. The RSA public-key encryption employs Optimal Asymmetric Encryption Padding.
SET is being published as open specifications for the industry, which may be used by software vendors to develop applications. (RSA.com, 2009)

Estioko (2007) states RAS is a famous variant of public key cryptography invented by cryptographers Ron Rivest, Adi Shamir, and Ron Adelman at MIT. RSA has become widely accepted, for example,
  • Integrates with Netscape and Internet Explorer browsers
  • More than 20,000,000 users worldwide
  • Part of S/MIME for secure email (e.g., Outlook Express, Lotus Notes, etc.) where S/MIME is Secure / Multiple Internet Mail Extensions – provide cryptographic security services for electronic messaging applications (authentication, message integrity, and nonrepudiation using digital signatures and privacy and data security using encryption).
RSA is an algorithm for public-key encryption. RSA 128-bits means highest level of encryption offering stronger security while the Personal Data like VISA card number, ID... etc is being passing through the Internet. The use of RSA 128-bit encryption for e-commerce is ...
  1. Providing secure transaction for Online Transaction to protect personal data. The example is http://www.flyingbean.com/?page=shop/help
  2. Secure File Transfer. The example is http://www.sylvansoftware.com/dropchutepro.htm
  3. Secure Application Server/Service. The example is http://www.information-management.com/news/1022600-1.html

Reference:

1. RSA.com (2009). "RSA Laboratories - 4.2.3 What is SET?". RSA Security, Retrieved from URL - http://www.rsa.com/rsalabs/node.asp?id=2287
2. Estioki Juan B (2007). "Introduction to E-commerce Security Risk". Association of Certified Fraud Examiners at National Computer Institute, Retrieved from URL - http://miss.dswd.gov.ph/dmdocuments/cobit-IT%20audit/Day%202-3%20JEstioko/Introduction%20to%20eCommerce%20Security%20Risk%20%5BRead-Only%5D.pdf