E-Commerce Security Environment – Detailed Notes
I. Dimensions of E-Commerce Security
In the context of e-commerce, security is not limited to just protection from hackers or
malware; it is a multidimensional concept that ensures the safe operation of electronic
transactions. These dimensions define what aspects of a system must be safeguarded.
1. Integrity
Definition & Explanation:
Integrity in e-commerce security refers to the assurance that the data being accessed or
transmitted has not been altered or tampered with during transmission. For instance,
when a customer places an order online, the transaction data such as quantity, price,
and shipping information must remain unchanged from the sender to the receiver. If
integrity is compromised, malicious actors could manipulate transaction data, causing
financial loss or service disruption. Digital signatures and cryptographic hash functions
are commonly used to ensure integrity in e-commerce systems.
2. Non-repudiation
Definition & Explanation:
Non-repudiation ensures that a party in a transaction cannot deny the authenticity of
their signature on a document or the sending of a message. In e-commerce, this is vital
for preventing buyers or sellers from falsely denying their involvement in a transaction.
Non-repudiation is typically achieved using digital signatures and audit logs. For
example, if a user initiates a fund transfer, they should not later claim that the request
was not made by them.
3. Authenticity
Definition & Explanation:
Authenticity refers to the ability to verify that users or systems involved in an e-commerce
transaction are who they claim to be. It is critical for preventing fraud and impersonation.
For instance, when a customer logs into an online store, the system must ensure it is the
real user, not a hacker. Authentication mechanisms like passwords, biometric checks,
OTPs (one-time passwords), and digital certificates help establish authenticity.
4. Confidentiality
Definition & Explanation:
Confidentiality ensures that sensitive information such as customer credit card details,
personal information, and login credentials is not disclosed to unauthorized entities. This
is essential for maintaining user trust and meeting regulatory requirements. Encryption
is the most commonly used method to ensure data confidentiality during online
transactions, especially over unsecured networks.
5. Privacy
Definition & Explanation:
Privacy in e-commerce refers to the control users have over how their personal data is
collected, stored, and used by businesses. Users expect that their information is not
sold, shared, or misused. Privacy policies, data protection laws (like GDPR), and secure
data handling practices help enforce privacy in e-commerce systems.
6. Availability
Definition & Explanation:
Availability ensures that e-commerce services are accessible and functional whenever
users require them. An online store that goes offline due to a cyberattack or technical
issue leads to loss of revenue and customer trust. Maintaining high availability involves
using redundant systems, cloud infrastructure, and protection against DoS and DDoS
attacks.
II. Security Threats in the E-Commerce Environment
E-commerce platforms face various internal and external threats. Understanding these
threats is essential to develop strategies for mitigation.
1. Malicious Code
Definition & Explanation:
Malicious code refers to software programs intentionally created to damage, disrupt, or
gain unauthorized access to systems. This includes viruses, worms, Trojans,
ransomware, and spyware. In e-commerce, malicious code can be embedded in files or
websites to steal customer data, alter product listings, or disable services. Prevention
requires antivirus software, code reviews, and secure development practices.
2. Unwanted Programs
Definition & Explanation:
Unwanted programs, also known as potentially unwanted programs (PUPs), are software
applications that users did not intentionally install or that behave in unexpected ways.
Examples include toolbars, adware, and software that alters browser settings. In e-
commerce, such programs can redirect users to fake websites, steal data, or hinder user
experience. Regular system scans and cautious software installations help prevent
them.
3. Phishing and Identity Theft
Definition & Explanation:
Phishing is a social engineering attack in which attackers impersonate legitimate entities
(e.g., banks, e-commerce platforms) to deceive users into revealing personal or financial
information. Identity theft occurs when this stolen data is used for fraudulent activities
such as opening accounts or making purchases. These threats are common in e-
commerce, often through fake emails or websites. Awareness campaigns, two-factor
authentication, and spam filters are key defenses.
4. Hacking and Cybervandalism
Definition & Explanation:
Hacking refers to unauthorized access or manipulation of computer systems or
networks, typically to steal or corrupt data. Cybervandalism is a form of hacking where
the intent is to deface websites, delete content, or cause disruptions. In e-commerce,
such attacks can lead to data breaches, service downtime, and reputational damage.
Firewalls, intrusion detection systems, and secure coding practices are essential for
protection.
5. Credit Card Fraud/Theft
Definition & Explanation:
Credit card fraud involves the unauthorized use of credit card information to make
purchases or withdraw funds. In e-commerce, this often happens through stolen card
numbers, phishing, or data breaches. Such fraud not only results in financial loss but also
weakens customer trust in online platforms. Solutions include tokenization, real-time
fraud detection systems, and compliance with PCI-DSS standards.
6. Spoofing
Definition & Explanation:
Spoofing is an attack in which a malicious party impersonates a legitimate website, email
address, or IP address to deceive users or systems. In e-commerce, spoofed websites
may look exactly like popular stores, tricking users into entering sensitive data. Email
spoofing may deliver fake order confirmations or password reset links. Verification of SSL
certificates and DNS filtering help in identifying spoofed entities.
7. Spamming
Definition & Explanation:
Spamming involves sending unsolicited messages or advertisements, often in large
volumes, to users via email, SMS, or comments. It clutters communication channels and
may carry malicious links or phishing messages. In the e-commerce context, spam can
overwhelm customer support, degrade performance, and harm brand reputation. Anti-
spam filters, CAPTCHA, and email verification techniques are used to reduce spam.
8. Sniffing
Definition & Explanation:
Sniffing is the unauthorized monitoring and capturing of data packets as they travel over
a network. If data is transmitted in plain text, attackers can intercept sensitive
information like login credentials or payment details. This is especially dangerous on
unsecured public Wi-Fi. Encrypted communication channels like HTTPS and the use of
VPNs are crucial to prevent sniffing.
9. Insider Attacks
Definition & Explanation:
Insider attacks are threats that come from employees, contractors, or other individuals
with authorized access to e-commerce systems. These insiders may abuse their access
to steal data, manipulate transactions, or install malware. Such attacks are difficult to
detect and can be highly damaging. Role-based access control, activity logging, and
behavioral monitoring are key preventive measures.
10. Denial of Service (DoS) Attacks
Definition & Explanation:
A Denial of Service (DoS) attack aims to make an online service unavailable by
overwhelming it with excessive traffic or malicious requests. In e-commerce, this can
disrupt sales, damage user experience, and lead to loss of revenue. DoS attacks can be
launched using automated bots or scripts. Load balancing, rate limiting, and application
firewalls help in managing such attacks.
11. Distributed Denial of Service (DDoS) Attacks
Definition & Explanation:
A Distributed Denial of Service (DDoS) attack is a more sophisticated version of a DoS
attack, where multiple systems (often compromised through botnets) flood the target
website or server simultaneously. DDoS attacks are difficult to mitigate because the
traffic originates from multiple sources. E-commerce businesses use cloud-based DDoS
mitigation services and redundancy to ensure service continuity.
III. Introducing Technology Solutions
To counter the above threats, various technology-based security solutions are employed
in modern e-commerce platforms.
1. Encryption
Definition & Explanation:
Encryption is a process of converting plaintext into ciphertext using cryptographic
algorithms to prevent unauthorized access. Only users with the correct decryption key
can access the original data. In e-commerce, encryption is used to protect data during
transmission (e.g., credit card numbers, passwords) and while stored. Common
algorithms include AES, RSA, and ECC. Encryption ensures confidentiality and integrity
of customer data.
2. Secure Socket Layer (SSL)
Definition & Explanation:
SSL (Secure Socket Layer), now commonly replaced by TLS (Transport Layer Security), is
a protocol that establishes a secure and encrypted connection between a web server and
a browser. It prevents third parties from intercepting data during transmission. Websites
using SSL are identified by “https” and a padlock icon. In e-commerce, SSL is essential
for securing login pages, payment gateways, and any data-sensitive transactions.
3. Firewalls
Definition & Explanation:
A firewall is a network security device or software that monitors and controls incoming
and outgoing traffic based on predefined rules. Firewalls act as a barrier between trusted
internal networks and untrusted external sources, such as the internet. In e-commerce,
firewalls help prevent unauthorized access, stop brute-force attacks, and filter malicious
traffic. Both hardware and software firewalls are used in combination for better
protection.
Types of Malware – Extended Short Definitions (E-Commerce Context)
1. Virus
A virus is malicious code that attaches itself to legitimate files and spreads when
the host file is executed, potentially corrupting data, disrupting systems, or
damaging web applications.
Example: An infected product catalog file that spreads malware across the e-
commerce admin systems.
2. Worm
A worm is a self-replicating malware that spreads independently across networks,
often consuming bandwidth or installing harmful payloads.
Example: A worm infiltrates an online store’s server, sending phishing emails to all
customers.
3. Trojan Horse
A Trojan appears as legitimate software but secretly executes harmful actions like
data theft or system control once installed.
Example: A fake inventory management plugin steals customer order details from
the backend.
4. Ransomware
Ransomware encrypts files or locks systems, demanding payment to restore
access, often paralyzing businesses.
Example: An online retailer's order database is encrypted, halting all sales until
ransom is paid.
5. Spyware
Spyware covertly monitors user activities and transmits sensitive data to
attackers without consent.
Example: A spyware-infected checkout plugin collects customer credit card and
address information.
6. Adware
Adware displays intrusive ads, and in some cases, redirects users to malicious e-
commerce clones to capture credentials.
Example: Users visiting your site get redirected to competitor scam pages with
lookalike branding.
7. Rootkit
Rootkits hide malicious activities and provide attackers with administrator-level
control over systems.
Example: An attacker uses a rootkit to disable an e-commerce site's firewall and
monitor all user activity.
8. Keylogger
Keyloggers record user keystrokes to capture sensitive information such as
usernames, passwords, and payment details.
Example: Customer credentials and card details typed on your login page are sent
to hackers.
9. Bot (Botnet Malware)
Bots turn infected systems into a network of zombie machines used for
automated attacks, like DDoS.
Example: Thousands of infected devices flood your e-commerce site, making it
unavailable to real customers.
10. Fileless Malware
This malware operates in memory, exploiting system tools without leaving
traditional files, making it hard to detect.
Example: A fileless attack leverages PowerShell to steal admin session tokens
from your e-commerce control panel.
11. Logic Bomb
A logic bomb activates malicious code when specific conditions are met, causing
sudden damage.
Example: A logic bomb embedded in a payment module deletes transaction logs
at month-end.
12. Scareware
Scareware manipulates users with fake alerts to buy fake antivirus or submit
personal data.
Example: A customer sees a pop-up claiming their system is infected while
browsing your online store.
13. Mobile Malware
Targets smartphones to steal personal data, access banking apps, or perform
unauthorized actions.
Example: A fake shopping app mimicking your store accesses users’ SMS and
bank messages.
14. Backdoor
Backdoors create unauthorized hidden access to systems, bypassing
authentication controls.
Example: An attacker implants a backdoor in your order system, allowing them to
alter transactions undetected.
Types of Attacks in E-Commerce Security
1. Phishing Attack
Definition:
An attack where users are tricked into revealing personal or financial information through
fake emails or websites that appear legitimate.
Example: A customer receives a fake email from "Flipkart" asking them to reset their
password through a fake login page.
2. Identity Theft
Definition:
Stealing someone's personal or financial information to impersonate them or commit
fraud on e-commerce platforms.
Example: An attacker uses stolen credit card data to make purchases on Amazon.
3. Hacking
Definition:
Unauthorized access to a system or network by exploiting vulnerabilities to steal data or
disrupt services.
Example: A hacker exploits a flaw in an online store’s backend to extract customer
details.
4. Cyber Vandalism
Definition:
Deliberate defacement or destruction of website content or features to damage
reputation.
Example: A competitor changes the homepage of an e-commerce website to offensive
images.
5. Spoofing
Definition:
Imitating a trusted website or service to trick users into giving up sensitive data.
Example: A fake "Paytm" payment gateway collects card information from users.
6. Spamming
Definition:
Sending unwanted or irrelevant messages in bulk, often containing malicious links or
ads.
Example: Fake promotional emails flood users’ inboxes, redirecting them to scam
websites.
7. Sniffing
Definition:
Intercepting data packets in transit to capture sensitive information like login details or
card numbers.
Example: On unsecured Wi-Fi, an attacker captures payment data sent during checkout.
8. Insider Attack
Definition:
A threat from within the organization where an employee misuses access to harm the
system or leak data.
Example: A staff member exports customer databases to sell on the dark web.
9. Denial of Service (DoS) Attack
Definition:
Flooding a server with excessive traffic to make a website slow or unavailable.
Example: An e-commerce site is overwhelmed with fake traffic during a sale, making it
crash.
10. Distributed Denial of Service (DDoS) Attack
Definition:
A coordinated DoS attack using multiple infected systems to overload a server.
Example: Thousands of bot-infected devices send requests to block access to an online
store.
11. Man-in-the-Middle (MitM) Attack
Definition:
An attacker secretly intercepts and possibly alters communication between two parties
without their knowledge, stealing sensitive data or injecting malicious content.
Example: On an unsecured Wi-Fi network, a hacker intercepts and modifies payment
information during a transaction.
