Volume : 5 | Issue : 1 | January 2016 ISSN - 2250-1991

Research Paper Management

Cyber Security; Issue and Challenges in E-Commerce

Santosh Kumar UGC- NET/JRF Research Scholar, Department of Management Studies, Nehru
Maurya Gram Bharati University, Allahabad
NagendraPratap UGC- RGNSRF Research Scholar, Department of Management Studies, Nehru
Bharati Gram Bharati University, Allahabad
E-Commerce refers to the exchange of goods and services over the Internet. The shopping through e-commerce
ABSTRACT

has penetrated all segments of goods ranging from groceries to electronic goods and even vehicles. Rapid growth
in mobile computing and communication technologies has facilitated popularity of e-commerce. The main impediment
in growth of e-commerce is cyberfraud and identity theft. Hackers are people who carry out the cybercrime. Hence, poor
security on e-Commerce web servers and in users computers is core issue to be resolved for rapid growth of e-commerce.
This paper provides directions for e-commerce security so as to improve customer confidence in e-commerce shopping.

KEYWORDS e-Commerce, Security, Threats and Vulnerabilities, Firewall, Session Hijack, Viruses.

Introduction complexity for an application to coordinate its internal states

The rapid evolution of online and mobile channels has carved with those of the component services and the web client
out new markets and brought huge opportunities for emer- across the Internet.
gent and established organizations alike. However, unfor-
tunately the past decade has also witnessed significant dis- E-Commerce offers the banking industry great opportunity,
ruption to ecommerce payment processes and systems. The but also creates a set of new risks and vulnerability such
interconnected, anonymous and instantaneous nature of these as security threats. Information security, therefore, is an
channels has inevitably led to the development of malicious essential management and technical requirement for any
threats targeting ecommerce and retail services firms, their efficient and effective Payment transaction activities over the
people and their customers. These e-crime and digital fraud internet. Still, its definition is a complex endeavor due to
threats continue to evolve rapidly, with attackers utilizing in- the constant technological and business change and re-
creasingly sophisticated techniques to target vulnerabilities in quires a coordinated match of algorithm and technical solu-
people, processes and technologies. The e-crime threats, if tions.
successfully realized, can undermine essential digital services,
cause significant damage to brand reputations, and result in Objective of Study
considerable financial and operational pain for organizations • Study the Overview of E-commerce security.
and their customers. • Understand the purpose of Security in E-commerce.
• Third Party risk in Online Shopping.
In order to achieve the security objectives, it is necessary to
recognize that the security of the services and the protection E-COMMERCE SECURITY TOOLS
of the customers’ data are essential. To this end, and specifi- • Firewalls – Software and Hardware
cally to support the current security equation, it is necessary to • Public Key infrastructure
have an enterprise wide target customer security model. This • Encryption software
should be designed to deliver enhancements to both custom- • Digital certificates
er-facing and back office security capabilities, and in particular • Digital Signatures
to improve existing security defenses for remote online, tele- • Biometrics – retinal scan, fingerprints, voice etc
phone and mobile banking channels. • Passwords
• Locks and bars – network operations centers
RELATED WORKS
Security is one of the principal and continuing concerns that Security issues in e-commerce application
restrict customers and organizations engaging withecom- There are following types of security issues in any e-commerce
merce. The aim of this paper is to explore the perception of application which needs to be addressed
security in e-commerce B2C and C2C websites from both cus-
tomer and organizational perspectives. Malicious Code:
• Viruses: They have ability to replicate and spread to
With the rapid development of E-commerce, security is- other files; most also deliver a “payload” of some
sues are arising from people’s attention. The security of sort (destructive or benign); include macro viruses, file-in-
the transaction is the core and key issues of the development fecting viruses, and script viruses
of E-commerce. This paper about the security issues of • Worms: They are designed to spread from computer to
E-commerce activities put forward solution strategy from computer
two aspects that are technology and system, so as to improve • Trojan horse: They appears to be benign, but then does
the environment for the development of E-commerce and something other than expected
promote the further development of E-commerce. • Bots: It can be covertly installed on computer; responds to
external commands sent by the attacker
Web applications increasingly integrate third-party services.
The integration introduces new security challenges due to the Unwanted Programs: These are installed without the user’s in-

191 | PARIPEX - INDIAN JOURNAL OF RESEARCH

Volume : 5 | Issue : 1 | January 2016 ISSN - 2250-1991

formed consent. Following are its types. Browser parasites: It 6. Digital Certificate
can monitor and change settings of a user’s browser Adware: A digital certificate is a digital document issued by a trusted
It calls for unwanted pop-up ads third party institution known as a certification authority that
contains the name of the subject or company, the sub-
Spyware: It can be used to obtain information, such as a user’s ject’s public key, a digital certificate serial number, an
keystrokes, e-mail, IMs, etc. expiration date, an issuance date, the digital signature of the
certification authority and other identifying information. The
Phishing and Identity Theft: Any deceptive, online attempt by Certification Authority (CA) is a trusted third party that
a third party to obtain confidential information for financial hands out certificates and publishes identities and public
gain – Most popular type: e-mail scam letter – It is one of fast- keys in a directory. The certificate is signed with the private
est growing forms of e-commerce crime. key of the Certification Authority; therefore, its authenticity
can be confirmed by using the known public key of the CA.
Hacking and Cyber vandalism: Hacker: Individual who intends
to gain unauthorized access to computer systems Recommendations
The rapid pace at which technology is changing has provided
• Cracker: Hacker with criminal intent (two terms often used large opportunities for organizations to develop new business
interchangeably) models, services, and products. While the digital revolution
• Cyber vandalism: Intentionally disrupting, defacing or de- has transformed the way we do business, it has also creat-
stroying a Web site. ed complex and sophisticated security issues. Assets and In-
formation that were once protected within the organization
Transaction Security for E-commerce Application are now accessible online; customer channels are vulnerable
1. Encryption Approach to disruption; criminals have new opportunities for theft and
Encryption is the process of transforming plain text or data into fraud. With organizations growing organically and inorgani-
cipher text that cannot be read by anyone other than the sender cally, complexity of managing businesses & security operations
and the receiver. The purpose of encryption is: are also becoming complex.

(a) To secure stored information and Organizations today thus face a continuously evolving threat
(b) To secure information transmission. landscape where the speed and intensity ofattack is incre-
menting and response time is subsiding. As a result, organi-
There are several types of encryption that differs in the context zations need to have rapid detectionand response capabilities
of its functionalities. that allow for the synthesis of external and internal threat
intelligence in a timely manner. This “situational awareness”
2. Secure Socket Layer is a required component of an organization’s overall security
The most common form of securing channels is through posture and critical to maintaining the confidentiality, integrity,
the Secure Sockets Layer (SSL) of TCP/IP. The SSL proto- and availability of its information assets. Some of the key rec-
col provides data encryption, server authentication, op- ommendations for an organization to step towards an effec-
tional client authentication, and message integrity for TCP/ tive security equation include:
IP connections. Secure Socket Layer (SSL) is a security proto-
col, first developed by Netscape Communications Corporation • Set risk appetite and drive focus on what matters. Establish
and now taken over by the transport layer security working purpose and direction. Clearly articulate your cyber risk ap-
groups. The design goal of the protocol is to prevent eaves- petite and strategy. Support it by requisite action through
dropping, tampering or message forgery when a data is funding and resourcing.
transported over the Internet between two communicating • Define the right balance between threat-centric vs. compli-
applications. ance-centric programs. Fully integrate cyber risk manage-
ment into IT disciplines.
3. Secure Hypertext Transfer Protocol (S-HTTP) • Break down silos. Cyber risk is an enterprise-level issue.
S-HTTP is a secure message-oriented communications pro- Lack of information-sharing is a top inhibitor for effective
tocol designed for use in conjunction with HTTP. It is risk management.
designed to coexist with HTTP and to be easily integrat- • Be creative about cyber risk awareness. Your weakest link
ed with HTTP applications. Whereas SSL is designed to is the human factor. There is not enough talent to do
establish a secure connection between two computers, everything in-house, so take a strategic approach to sourc-
S-HTTP is designed to send individual messages securely. ing decisions.
Using S-HTTP, any message may be signed, authenticat- • Incentivize openness and collaboration. Build strong rela-
ed, encrypted or any combination of these. Generally, tionships with partners, law enforce -ment, regulators, and
S-HTTP attempts to make HTTP more secure. vendors.
• Prepare for cyber-attacks by conducting war games, pen-
4. Digital Signature etration tests, and exercising the cyber incident response
Digital signature means a digital method executed by a plans.
party with the intent to authenticate a record, which • Have a threat intelligence mechanism in place Focus on
is a unique to the person using it and is capable of verifica- restructuring the diverse unstructured security data and
tion. It is linked to the data in such a manner that if the data information gathered from all the security entities and
is changed, the electronic signature is invalidated. A digital devices (recent and past events) to consolidate intelligent
signature is normally a hash of the message which is feeds, advice or a product, which could be used to make
encrypted with the owner’s private key. informed decisions in order to mitigate dynamic threats as
pet the environment.
5. Secure Electronic Transaction (SET)
A SET specification for credit/payment card transactions is re- Conclusion
quired for the safety of all involved in e-commerce. It is de- E-commerce is widely considered the buying and sell-
signed to meet three main objectives. First, it will enable pay- ing of products over the internet, but any transaction
ment security for all involved, authenticate card holders and that is completed solely through electronic measures can
merchants, provide confidentiality for payment data and be considered e-commerce. Day by day E-commerce and
define protocols and potential electronic security service M-commerce playing very good role in online retail mar-
providers. It will also enable interoperability among applica- keting and peoples using this technology day by day
tions developed by various vendors and among different oper- increasing all over the world.
ating systems and platform.

192 | PARIPEX - INDIAN JOURNAL OF RESEARCH

Volume : 5 | Issue : 1 | January 2016 ISSN - 2250-1991

E-commerce security is the protection of e-commerce

assets from unauthorized access, use, alteration, or de-
struction. Dimensions of e-commerce security; Integrity:
prevention against unauthorized data modification, No re-
pudiation: prevention against any one party from reneg-
ing on an agreement after the fact. Authenticity: authen-
tication of data source. Confidentiality: protection against
unauthorized datadisclosure. Privacy: provision of data control
and disclosure.

REFERENCES

1. Review of e-Commerce Security Challenges by Jarnail Singh in International Journal of Innovative Research in Computer and Communication Engineering. | 2. Stuart
Feldman, “The Changing Face of E-Commerce: Extending the Boundaries of the Possible”, IEEE INTERNET COMPUTING, MAY -JUNE 2000, pp:82-83 | 3. JOSE A. ONIEVA,
“Multiparty Nonrepudiation: A Survey”, ACM Computing Surveys, Vol. 41, No. 1, Article 5, December 2008, pp:5.1-5.42 | 4. Adam Jolly, “The Secure Online Business”,
Great Britain and the United States- Kogan Page Limited 2003, pp: 93-118 | 5. PETER C. CHAPIN, CHRISTIAN SKALKA, and X. SEAN WANG, “Authorization in Trust Man-
agement: Features and Foundations”, ACM Computing Surveys, Vol. 40, No. 3, Article 9,August 2008,pp: 9.1-9.48 | 6. DonalO.Mahony, Michael Peirce Hitesh Tewari,
“Electronic Payment Systems for E-Commerce“, Artech House computer security series-Boston 2001, Second Edition, pp: 19-69 | 7. MohitKabra Chief Financial Officer,
MakeMyTrip.in Future of e-Commerce: Uncovering Innovation page no.27 |

193 | PARIPEX - INDIAN JOURNAL OF RESEARCH