Security categories

Security as a Foundation of E-Business

The lecture introduces security as a foundation of e-business. Online transactions—especially those involving confidential information and payments—depend on security. Without it, customers are unlikely to trust e-business systems.

Six Security Categories

1. Identification, authentication, and authorization (“lawful use”)

   • Identification establishes who a user or system claims to be, such as when someone enters a username.
   • Authentication checks whether the claimed identity is genuine, such as by verifying a password.
   • Authorization determines what an authenticated user is permitted to do. For example, a bank customer may view their own account but not other customers’ accounts.

2. Confidentiality or privacy

   • Protects message contents and data from people who are not authorized to see them.
   • Internet traffic is divided into packets and routed across networks, where it may be intercepted.
   • Encryption can make transmitted data unreadable to an interceptor, including sensitive details such as credit-card information.

3. Data integrity

   • Protects data from being changed during transmission.
   • Packets contain application data and header information, such as source and destination addresses and TCP sequence information. Changes to either could alter or redirect traffic.

4. Availability

   • A system should be accessible when legitimate users need it. A failure or attack affecting one part should not bring down the entire service.
   • The lecture illustrates a denial-of-service (DoS) attack using TCP’s three-way handshake:
     1. A client begins a connection by sending a synchronization request.
     2. The server responds with an acknowledgment and its own sequence information.
     3. The client is expected to acknowledge the response and proceed with data.
     4. If an attacker repeatedly starts connections but never completes them, the server can be left waiting and its limited connection capacity can be exhausted.

5. Non-repudiation

   • Prevents a sender from credibly denying that they sent a message or authorized a transaction.
   • This is important in e-commerce and banking. For example, a bank should be able to provide evidence that a transfer instruction was submitted.

6. Audit and traceability

   • After a security breach or other significant event, transaction records can be reviewed to help determine what happened and why.
   • Auditing supports investigation and accountability.

Authentication: Server and Client

Authentication can apply in either direction:

• Server authentication: The client checks that it is communicating with the intended server. This matters when submitting payment or personal information, because a fraudulent site may imitate a legitimate bookstore or bank.
• Client authentication: The server checks that the user or customer is genuine, as a bank or credit-card company would need to do.

Interception and Address Manipulation

The lecture discusses two packet-related threats:

• Sniffing: A program or device monitors network traffic and attempts to read information from packets. The lecture describes this as a passive form of interception. By itself, sniffing is primarily a threat to confidentiality.
• IP spoofing: An attacker changes or falsifies IP-address information, potentially causing packets to be misdirected. This is an active manipulation of network traffic.

The lecture groups sniffing and spoofing as packet attacks, though their effects differ: sniffing exposes information, while spoofing alters or falsifies traffic.

Speakers or Sources Featured

• One unnamed lecturer or instructor presents the security concepts and examples.
• No other speakers or external sources are identified in the subtitles.