Roger Clarke's Web-Site © Xamax Consultancy Pty Ltd,  1995-2024
HOME	eBusiness	Information Infrastructure	Dataveillance & Privacy	Identity Matters	Other Topics
What's New		Waltzing Matilda	Advanced Site-Search

ANU COMP3410 - I.T. for eCommerce
Security of eTrading - Topic Outline

Roger Clarke **

Version of 21 Aug 2012, revs. 6, 26 Sep, 4 Oct 2012

REQUIRED READING for Lecture 1, added 26 Sep 2012: 'Data breach at IEEE.org: 100k plaintext passwords' 24 Sep 2012

REQUIRED READING for Lecture 4, added 4 Oct 2012: Mobile Banking Fact Sheet, 26 September 2012

© Xamax Consultancy Pty Ltd, 2012

This document is at http://www.rogerclarke.com/EC/ETSecy.html

Introduction

This 4-hour segment continues on from the earlier 6-hour series of eTrading topics. It provides a brief overview of information security generally, then considers important security aspects of electronic and mobile commerce.

Contents

• Lecture Outlines
  • Lecture 1 - Security of Information and IT
  • Lecture 2 - Malware and Other Attacks
  • Lecture 3 - Identity in Marketspaces
  • Lecture 4 - Mobile Security
• The Examinable Materials
• Discussion Topics for the Tutorial Session

Lecture Outlines
Lecture 1: Security of Information and IT

Week 10 - Tue 9 October, 10:00-11:00, Dedman 102 - (Slides in PPT97 and in PDF)

This session introduces the notion of security, and then the conventional models of information security and I.T. security. An overview is provided of the processes of risk assessment and risk management. Safeguards are presented within a general IT security architecture. An overview of access control is provided, as an important cases study in safeguards.

SUB-TOPICS AND REQUIRED READINGS

The Notion of Security

• Introduction to Information Security, ss. 1-3

The Conventional Security Model

• Appendix 1: Glossary of Security Terms
• TBA

Risk Assessment and Risk Management

• The Information Security Process, s. 5

Safeguards

• Appendix 4: Conventional Categories of Security Safeguard

Access Control

• NIST'S Introduction to Role-Based Access Control
• Garfinkel Ch. 9, pp. 230-242 (Passwords)
• What Everyone Ought to Know About Passwords
• 'Data breach at IEEE.org: 100k plaintext passwords' 24 Sep 2012 [ADDED 26 Sep 2012]
• Goodin D. (2012) 'Why passwords have never been weaker--and crackers have never been stronger' Ars Technica, 21 August 2012

FURTHER READING

The Conventional Security Model

• Wikipedia on Information Security (It captures nicely the enormous confusion in the area)
• Wikipedia on Network Security
• Wikipedia on Computer Insecurity

Risk Assessment and Risk Management

• Wikipedia on Risk Management
• ISACA's RiskIT Framework (4.4MB of PDF)
• Standards documents:
  • ISO/IEC 13335:2004 - Concepts and Models
  • ISO/IEC 27000 series (IT Risk Management), esp.:
    • ISO/IEC 27005:2008 Information Technology - Security Techniques - Information Security Risk Management
  • ISO/IEC 31000 series (Risk Management, not specifically IT). This superseded an earlier Australian-originated standard, AS/NZS 4360:
    • ISO 31000:2009 - Risk management -- Principles and guidelines
    • ISO Guide 73:2009 - Risk management -- Vocabulary
    • ISO/IEC 31010:2009 - Risk management -- Risk assessment techniques
  • NIST SP 800-30 - Risk Management Guide for Information Technology Systems (July 2002)
  • NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View (Mar 2011)
  • COBIT (Control Objectives for Information and related Technology) - ISACA framework for information technology (IT) management and IT Governance, currently v.4.1 (2007)

Safeguards

• Garfinkel:
  • Ch. 11, pp. 284-297 (Backups and Anti-Theft)
  • Ch. 14 (Physical Security for Hosting Devices)
  • Ch. 21 (Code Signing)
• Weber R. & Jamieson R. (2008) 'Information Systems Control Audit' Pearson Education Australia, 2008

Access Control

• Wikipedia on Two-Factor Authentication
• Garfinkel Ch. 20 (Access Control to Web Content)

Lecture 2: Malware and Other Attacks

Mon 15 October, 10:00-11:00, Dedman 102 - (Slides in PPT97 and in PDF)

This session examines the diverse forms of malware and other kinds of attacks, which represent complex and increasingly sophisticated challenges to delivering reliable IT services. The available safeguards are presented.

SUB-TOPICS AND REQUIRED READINGS

1. Malcontent, Malbehaviour, Malware

• How Much Illegal Porn is on Your Personal Devices?
• The Feasibility of Consumer Device Security. Read all of it; but only s.4 is examinable. The particularly important parts are ss. 4.2 and 4.4, but those sections won't make sense unless you read it all
• Categories of Malware
• Wikipedia on Push Technology

2. Safeguards Against Malware

• Wikipedia on Anti-Virus Software
• Maurushat A. (2010) 'Zombie Botnets' SCRIPTed 7, 2 (2010) 370

3. Attacks and Safeguards

• Garfinkel Ch. 15 (Host Security for Web-Servers)

4. DOS Attacks and Safeguards

• Wikipedia on Denial-of-Service Attack

FURTHER READING

1. Malcontent, Malbehaviour, Malware

• Garfinkel:
  • Ch. 8 (The Web's War on Your Privacy)
  • Ch. 9, pp. 242-255 (Browser and Email Safeguards)
  • Chs. 12 and 13 (Mobile Code)
• StaySmartOnline on Phishing
• StaySmartOnline on Social Engineering
• StaysmartOnline's 'What to do about Malware', Part 1, Part 2, Part 3
• Wikipedia Timeline of Notable Computer Viruses and Worms
• The Wikipedia Entries (only the generic information is examinable. Fine details, and the names and specific characteristics of particular threats and instantiations are too detailed to remember, and are rapidly changing)
• Re-Conceptualising Malware
• SANS Malware FAQ
• IBM Tutorial on AJAX, Reverse AJAX / Comet

2. Safeguards Against Malware

• Microsoft Malicious Software Removal Tool
• StaySmartOnline on Free Security Software
• Wikipedia List of Antivirus Software

3. Attacks and Safeguards

• Garfinkel:
  • Ch. 16 (Web Application Security)
  • Ch. 19 (Computer Crime)
• Team Cymru's Anatomy of a Network Attack (PDF, 3.2MB)
• Gandhi R. et al. (2011) 'Dimensions of Cyber-Attacks' IEEE Technology and Society Magazine 30, 1 (Spring 2011) 28-38, mirrored here (PDF, 1.4MB)
• NIST's Guidelines on Firewalls and Firewall Policy (2009)
• DSD's Strategies to Mitigate Cyber Intrusions

4. DOS Attacks and Safeguards

• SANS' Consensus Roadmap for Defeating Distributed Denial of Service Attacks

General

• Sophos' Security Threat Report 2011 (8MB!)

Lecture 3: Identity in Marketspaces

Tue 16 October, 09:00-10:00, Dedman 102 - (Slides in PPT97 and in PDF)

The effectiveness of a trading scheme depends on trust by participants in one another's behaviour, and in the infrastructure supporting the activity. Identification (of parties and of tradable items) is one factor. Developing confidence in the assertions that parties make, referred to as 'authentication', is crucial. Biometric technologies have potential benefits, but bring with them significant risks. The roles of anonymity and pseudonymity also need to be understood.

There's a widespread presumption that, in cyberspace moreso than in meatspace, you need to know who you're doing business with. To test the prevailing presumptions about identities in marketspaces, it's necessary to study the concepts of identification, of anonymity and pseudonymity, and of authentication, and the technologies that both support and threaten consumers' interests.

SUB-TOPICS AND REQUIRED READINGS

1. (Id)entification and Authentication

• Terminology
• Myths 7 and 8 on Authentication (the rest of the document is Further Reading, but is not examinable)

2. Identity Management

• Identity Management (that section only, i.e. 'Myth 6')

3. Biometrics

• Biometrics (sections on Biometrics; How It Works; Uses; and Effectiveness, Accuracy and Benefits)

4. Nymity

• Anonymity and Pseudonymity (sections 3.3 and 3.4 only)
• Id, Anonymity and Pseudonymity on the Internet (section 7 only)
• 'Corporate Case in Ohio Raises Questions on Internet Anonymity' (NYT, 17 October 2000)

5. PITs and PETs

• Introducing PITs and PETs: Technologies Affecting Privacy

6. Dig Sigs and PKI

• The Fundamental Inadequacies of Conventional Public Key Infrastructure

7. Location and Tracking

• Concepts - s.2 only
• Handhelds - s.4.1 only

FURTHER READING

1. Identification, Anonymity and Pseudonymity

• Human Identification
• (Id)Entities (Mis)Management: The Mythologies underlying the Business Failures (note that Myths 7 and 8 are examinable)
• The Digital Persona

2. Biometrics

• Biometrics' Inadequacies and Threats, and the Need for Regulation

3. PETs

• Garfinkel Ch. 10 (Privacy-Protecting Technologies)
• Anonymity and Pseudonymity Services
• Tools

4. Privacy-Sensitive Public Key Infrastructure

• Conventional PKI (whole of section 5)
• Privacy Requirements of PKI
• Pretty Good Privacy (PGP)
• Simple Public Key Infrastructure (SPKI)
• Simple Distributed Security Infrastructure (SDSI)

Lecture 4: Mobile Security

Tue 16 October, 10:00-11:00, Dedman 102 - (Slides in PPT97 and in PDF)

This session reviews user access devices and access channels in order to consider different patterns of mobile usage among different demographics. The parallel explosions in mobile devices and wireless connectivity are creating new challenges; and Baby Boomers, Gen-X, Gen-Y and iGens use them differently. Mobile security is considered, focussing on payments. The general approach to risk management is then applied to mobile payments.

SUB-TOPICS AND REQUIRED READINGS

1. Mobile Technology Users

• The iGeneration and The Privacy Attitudes of the iGeneration

2. Mobile Payments

• Contactless Cards - Payment Risks (Tyree A., March issue of the Journal of Banking and Finance Law and Practice, March 2010)

3. Risk Assessment for Mobile Payments

• A Risk Assessment Framework for Mobile Payments

4. Risk Management for Mobile Payments

• ABA/AFP (2012) 'Banking on the go - security tips for your smartphone and tablet', September 2012

FURTHER READING

3. Risk Assessment for Mobile Payments

• Electronic Funds Transfer Code of Conduct - version of 1 July 2012, but phasing out
• ePayments Code - phasing in, by 30 March 2013

The Examinable Materials

The examinable materials comprise the following:

• the Required Readings listed in the Lecture Outlines above
• the slide-sets linked to from the Lecture Outlines above
• any additional material provided during Lectures

The Further Reading is not examinable. It's provided in order to enable you to 'drill down' on topics you're particularly interested in.

Discussion Topics for the Tutorial Session

A. Your mobile devices have been impounded by the university, under suspicion of containing:

• instructions for preparing and detonating home-made bombs
• illegal pornography (technically, 'refused classification (RC) material')
• copyright-infringing music and video
• malware that makes your device part of a botnet that generates spam

1. What challenges do the investigators have to overcome in order to establish a case against you?

B. The investigators have found some material, and have accused you of committing criminal acts by having that material on your devices.

1. How could that material have got onto your device?
2. What can you do to defend ourself against the accusations?

C. On your own mobile devices:

1. What perimeter safeguards do you have?
2. What internal safeguards do you have?
3. Are further safeguards available that you're not using?
4. Are there additional safeguards that you'd like to have, but that aren't available to you?

D. Your software providers offer to update your operating system, virus-protection and apps automatically, by pushing patches over the network and an auto-instalment service to put them on your device, and activate them.

1. Which is better: to let them do it; or to decide for yourself whether and when to apply updates to your software?

E. Births Registries issue birth certificates.

1. How much care should a Birth Registry take when someone asks them for a copy of your birth certificate?
2. Are there any differences between someone asking for a copy face-to-face and asking online?
3. What options are open to them to authenticate the assertions made by the applicant?
4. When you try to get a copy of your own birth certificate, will you be able to authenticate yourself to their satisfaction?

F. Lecture 4, Slides 5-9, outlined some 'dimensions of differentiation' among users of mobile devices.

1. Use these dimensions to categorise yourself. Do you think the dimensions are relevant to mobile device usage? Are they comprehensive, or are there other important factors?
2. Describe another category of user that's quite different from yourself.
3. What advice would you give that category of user about how to protect themselves against harm arising from use of their mobile devices, both generally and in the particular context of mobile payments?
4. Is that advice the same as you would give to yourself and people like you? Or similar? Or quite different? Why?
5. Do you act on your own advice?

Author Affiliations

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the Research School of Computer Science at the Australian National University,, and in the Cyberspace Law & Policy Centre at the University of N.S.W.

Personalia

Photographs Presentations Videos

Access Statistics

The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax. From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 65 million in early 2021. Sponsored by the Gallery, Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer

Xamax Consultancy Pty Ltd ACN: 002 360 456 78 Sidaway St, Chapman ACT 2611 AUSTRALIA Tel: +61 2 6288 6916

Created: 19 March 2000 - Last Amended: 4 October 2012 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/EC/ETSecy.html
Mail to Webmaster   -    © Xamax Consultancy Pty Ltd, 1995-2022   -    Privacy Policy