Mans Our
This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA
Overview
Download & View Mans Our as PDF for free.
More details
- Words: 15,417
- Pages: 76
INTERNET SECURITY AND USAGE
Mansuor H. Almalki
This dissertation is submitted in partial fulfilment of the requirements for the degree of Master in Internet, computer and system Security
DEPARTMENT OF COMPUTING UNIVERSITY OF BRADFORD
2007
Abstract
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
MSc Internet Computer and System Security 2006/08 Internet Security and Usage By Mansour H. Almalki Project Supervisor: Dr Mumtaz A. Kamala
The increasing of E-commerce with its significance to the global trade system, the security of E-commerce and mainly of their Web sites becoming more important. Many systems have been planned to ensure confidentiality, authentication and integrity of transactions. On the other hand, even if some of these resolutions have been deployed, security side of E-commerce is still easily broken. E-Commerce Web still vulnerable to many kinds of attacks, which are developing incessantly. For instance, ECommerce Web sites such as HSBC bank, Boots and EBay have been subject of fabulous stories of attacks such as DOS, Phishing or other kind of passive attacks that have caused significant harms and losing of a lot of money as well as the trust of customers. The aim of this dissertation is to propose the E-commerce approach to improve security against the new generation of E-commerce attacks. Because of the enormous of this subject, businesses to consumer Web site will developer to be an example and to be easier to show that how the security mechanisms have done.
Dedications To my wife, for your continued moral support and encouragement during the year that I wish it could have lasted forever and to my parents, for your continued support and for offering me this big opportunity to move on with my studies.
Acknowledgements This research report has been submitted with the continued help and instructions of my supervisor, Dr Mumtaz A. Kamala. I am able to produce this report due to her guidance throughout the process of the research. Special thanks to him for his helping during the period, which are, spend together.
Table of Contents Abstract....................................................................................................2 Dedications..............................................................................................2 Acknowledgements................................................................................2 LIST OF TABLES.......................................................................................7 2
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
LIST OF FIGURES....................................................................................8 Chapter 1 Introduction.............................................................................10 1.1 Project Overview...........................................................................................................................10 1.2 Scope of the Dissertation...............................................................................................................10 1.3 Technologies to be Used................................................................................................................10 1.4 Background....................................................................................................................................11
Chapter 2 Security Principals..................................................................12 2.1 Understanding the Levels of Security............................................................................................12 2.2 The Goals of Security in E-Commerce..........................................................................................14 2.3 Secure Web site Guidelines...........................................................................................................14 2.4 Security Threats.............................................................................................................................15 2.4.1 Malicious code.....................................................................................................................................16 2.4.2 Hacking...............................................................................................................................................16 2.4.3 Information Gathering.........................................................................................................................16 2.4.4 Denial of service attacks (DOS)...........................................................................................................16 2.4.5 Internal attacks.....................................................................................................................................16
Chapter 3 Security and Usage.................................................................17 3.1 Encrypting Sensitive Data in a Database.......................................................................................17 3.1.1Introduction..........................................................................................................................................17 3.1.2 How It Work........................................................................................................................................17
3.2 Avoid SQL Injection Attacks........................................................................................................18 3.2.1 SQL injection techniques.....................................................................................................................18 3.2.2 To help protect against a SQL Insertion attack:...................................................................................19
3.3 On–Screen Keyboard.....................................................................................................................21 3.4 Password Security..........................................................................................................................21 3.4.1 Introduction.........................................................................................................................................21 3.4.2 General password construction policies...............................................................................................21
3.5 SSL (Secure Socket Layer protocol).............................................................................................22 3.5.1 Introduction.........................................................................................................................................22 3.5.2 SSL Certificate....................................................................................................................................22 3.5.3 Installing SSL......................................................................................................................................23
3.6 EV SSL (Extended Validation Secure Socket Layer protocol).....................................................23
Chapter 4 Payment Systems...................................................................26 4.1 Introduction....................................................................................................................................26 4.2 Online Payment Methods.............................................................................................................26 4.2.1 Introduction.........................................................................................................................................26 4.2.2 Payment Gateway (Real Time):...........................................................................................................26 4.2.2.1 Merchant Account.............................................................................................................................26 4.2.3 Payment processors (Delayed Response).............................................................................................28
4.3 Offline Payment Systems...............................................................................................................29
Chapter 5 Literature Review....................................................................30 5.1 introductions..................................................................................................................................30 5.2 Boots..............................................................................................................................................30 5.3 Dixons............................................................................................................................................30 3
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
5.4 Flowers direct................................................................................................................................31
Chapter 6 Work Plan...............................................................................32 6.1 Time Table.....................................................................................................................................32
Chapter 7 Methodology...........................................................................33 7.1 Introduction....................................................................................................................................33 7.2 Water Fall Model...........................................................................................................................33
Chapter 8 System Analysis......................................................................35 8.1 Introduction....................................................................................................................................35 8.2 Requirements Gathering................................................................................................................35 8.3 Interview........................................................................................................................................35 8.4 Questionnaires...............................................................................................................................36 8.5 Task Analysis.................................................................................................................................36 8.5.1 Admin Registration..............................................................................................................................38 8.5.2 Admin Login........................................................................................................................................38 8.5.3 Category..............................................................................................................................................38 8.5.4 Item......................................................................................................................................................38 8.5.5 Report..................................................................................................................................................38 8.5.6 Cart......................................................................................................................................................38 8.5.7 Checkout..............................................................................................................................................39
Chapter 9 System Design........................................................................40 9.1 Introduction....................................................................................................................................40 9.2 Use Case Diagrams........................................................................................................................40 9.2.1 System Boundary.................................................................................................................................41 9.2.2 Registration..........................................................................................................................................41 9.2.3 Login...................................................................................................................................................42 9.2.4 Category..............................................................................................................................................43 9.2.5 Item......................................................................................................................................................44 9.2.6 Cart......................................................................................................................................................45 9.2.7 Checkout..............................................................................................................................................46 9.2.8 Administration Report.........................................................................................................................48 9.2.9 Customer Report..................................................................................................................................49 9.2.10 Logout...............................................................................................................................................50
9.3 Class Diagram................................................................................................................................51
Chapter 10 Implementation.....................................................................52 10.1 Introduction..................................................................................................................................52 10.2 System Mode...............................................................................................................................52 10.2.1 Console Based Application................................................................................................................52 10.2.2 Web Based Application.....................................................................................................................53 10.2.3 Chosen Mode of Application.............................................................................................................54
10.3 Programming Language...............................................................................................................54 10.3.3 ASP.NET...........................................................................................................................................54
10.4 Database Management System....................................................................................................56 10.4.1 Introduction.......................................................................................................................................56 10.4.2 Coding...............................................................................................................................................56
4
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
10.4.3 Project Interface with Description......................................................................................................62
Chapter 11 Testing..................................................................................70 11.1 Introduction..................................................................................................................................70 11.2 Test Plan......................................................................................................................................70
Chapter 12 Conclusion............................................................................71 12.1 Introduction..................................................................................................................................71 12.2 Critical Assessment......................................................................................................................71 12.2 What have been done...................................................................................................................72
References...............................................................................................73 APPENDICES..........................................................................................75 Appendix A Test plan..........................................................................................................................75 Appendix B The interview questions with its results..........................................................................79 Appendix C The interview questions with its results..........................................................................81 Appendix C The interview questions with its results
LIST OF TABLES Table 3.1 Characters Using in SQL Code Injection.....................................................25 Table 6.1 Time Table...................................................................................................37 Table Appendix A Test Plan No. 1...........................................................................78 Table Appendix A Test Plan No. 2...........................................................................79 Table Appendix A Test Plan No. 3...........................................................................80 Table Appendix A Test Plan No. 4...........................................................................81
5
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
LIST OF FIGURES Figure 2.1 Levels of Security.......................................................................................14 Figure 2.2 Points the Attacker can Target....................................................................18 Figure 3.2 IE7 Address Bar with EV SSL...................................................................29 Figure 3.3 IE7 Address Bar Securities with EV SSL...................................................30 Figure 4.1 Payment Gateway ......................................................................................31 Figure 4.2 PayPal Gateway..........................................................................................33 Figurer 7.1 Water Fall Model.......................................................................................36 Figure 8.1 Task Analysis..............................................................................................48 Figure 9.1 Use Case Diagrams.....................................................................................51 Figure 9.2 System Boundary Diagram.........................................................................52 Figure 9.3 Registration Diagram..................................................................................52 Figure 9.4 Login Diagram............................................................................................53 Figure 9.5 Category Diagram.......................................................................................54
6
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 9.6 Item Diagram..............................................................................................55 Figure 9.7 Cart Diagram...............................................................................................56 Figure 9.8 Checkout Diagram......................................................................................57 Figure 9.9 Administration Report Diagram.................................................................59 Figure 9.10 Customer Report Diagram........................................................................60 Figure 9.11 Logout Diagram........................................................................................61 Figure 9.12 Class Diagram...........................................................................................62 Figure 10.1 Login Form...............................................................................................77 Figure 10.2 Onscreen Keyboard Form.........................................................................78 Figure 10.3 Adding New Category Form.....................................................................79 Figure 10.4 View and Update Categories Form...........................................................80 Figure 10.5 Add New Item Form.................................................................................81 Figure 10.6 Add Item to Cart Form..............................................................................82 Figure 10.7 Checkout Form.........................................................................................83 Figure 10.8 Report Form..............................................................................................84 7
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 1 Introduction 1.1 Project Overview “E-Commerce embraces all aspects of buying and selling products and services over a network.” (Norris & West 2001) Since the author studied at the university, he was focusing on Internet and System Security where E-commerce is found the most attractive field to implement this sort of knowledge. However, the growth of shopping over the Internet is encouraging more businesses to consider the profits of developing E-Commerce Web sites. Although online shopping has great and clear advantages, there are also many security issues that should be understood when E-Commerce website is developed. The overall aim of this master dissertation is how to build a Business to Consumer website that is a kind of E-commerce and how to investigate the major security threats in the E-commerce world and their lasts solutions that an online Web site may face. In particular, the project aims to the importance of cryptography, validation, create secure session, SSL, avoid SQL injection, password polices and electronic payment method by designing keys that can help to view the security on online Web site. This research provides the basis for a comprehensive Internet security, which can be developed further.
1.2 Scope of the Dissertation •
Development of online shopping Web site. 8
Mansour H. Almalki •
• •
MSc. Internet computer and System Security, 2007
Application of security in E-commerce techniques to acquire practical knowledge of security systems. Improvement of usability and acceptability of product. Informing the new technology and development in security system.
1.3 Technologies to be Used The online shopping Web site Tools is implemented using the high level language which is ASP.NET 2.0 with Visual Basic.NET script as front end programming language and JAVASCRIPT as client end validation language. SQL SERVER 2005 (express edition) used for storing the data in the database and SQL SERVER MANAGEMENT STUDIO for managing the database. Moreover, used MICROSOFT WORD 2007 and MICROSOFT VISIO 2003 for drawing the diagrams and organizing the document.
1.4 Background Turban et al (2003) their recent research paper found that E-commerce could bring the following benefits to both organization and consumer: • Offer significant cost saving since E-commerce a lower technology cost. • Market of products will be on an international level. • The organization work’s speed and flexibility will be improved dramatically. • Decision making will be developed to follow the new technology. • The customer base will be increased. • Lower procurement cost for both organization and consumer. • Business intelligence will be improved. Turban et al (2003) have shown that E-Commerce almost is not a new type of commerce. It first appeared on local networks, as normally large company developed electronic data interchange installations and banks implemented electronic funds transfer. Otherwise, the Internet and mainly the World Wide Web not only show the large companies, it also provides a viable entrance point for small and middle-sized projects into E-Commerce world. E-commerce can be one of these topics: B2B (business-to-business), B2G (business-to-government), B2C (business-toconsumer), C2C (consumer-to-consumer), G2B (government-to-business). Most public are familiar with Consumer-to-Consumer electronic business (C2C) like Auction web site and the good example is EBay. Furthermore, there is Business-to-Consumer electronic business (B2C) like Amazon, Boots, T-mobile, etc. The Business to Consumer is involved to present online products, services and information to a large filed of internet customers. The Web sites which offer consumer banking facilities, online shopping, and other services. They will continue by having a proficient management team, 9
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
perfect post sales system, a good network infrastructure, attractive designed website and a security mechanism against hacker or eavesdropper. In addition, online shopping Web site publishes news and information about its products and services. This information may contain a description of the products and services along with appropriate static, video and images. This view has been supported in the work of Rajput (2000).
Chapter 2 Security Principals 2.1 Understanding the Levels of Security The important factor to create a secure environment is to start with security which include the main principles of security (confidentiality, integrity and availability).This means applying the principles of security as the base, which the rest of the project will be made that mean to achieve a high level of security the project must address these principles in all phases and applications from beginning to end. Overall, for typical web applications, the primary tasks for implementing security are always the same. According to Russsell et al (2001), the levels of security contain:
Figure 2.1: Levels of Security. Confidentiality: it means that information is available only to users authorized to access it. It is for the most part widely known of the principles. Businesses have been dealing with confidentiality while commerce started. Now, it is a critical expectation of customer that their personal information will be in secure. Merchant also expect a level of confidentiality to protect price, custom scheduling and customer details. The idea of confidentiality is widely accepted. Conversely, remains difficult to execute.
10
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Information is probably one of the most costly resources most companies have; losing it or carelessness for it could do disaster and possibly even spoil. For that reason, while the user is handling with the online Website, it has to be ensuring that nobody else is able to sight sensitive data, which is processed by the user. Consequently, the line between the consumer’s browser and the web server has to be encrypted. In addition, the data stored on the cookies on the client have to be encrypted; even database administrators or other employees of the company where the web application is hosted may not view the data. There are some important question it should be though about it, if the company had cracked the files of these customers, what would the damage to the company have been? How would the company deal with such a situation? Integrity: Information is accessed only by right users. This can also be referred to as defining levels of security. It is perhaps the most complex of the principles to achieve, up until now it is the most fundamental of the three. Businesses have to build, manage and maintain the integrity of the information with which they are entrusted. The least corruption of that data can make whole chaos. Constantly, different ways have developed for manage and maintaining the integrity of information. There are many entries accounting system, the creation of works such as editors and proofreaders, and the modern checksum methods are all technical advances intended at producing integrity. However, even all of that, integrity still one of the greatest worthwhile. Integrity is something we approximately take for granted. We suppose that the database system, which we are using, will maintain the records of our sales perfectly. We consider that our billing system is smart by default to add the goods on a customer’s invoice. The lacking of some type of integrity checking, neither of these conditions may be true. Integrity of information can have an even larger impact on the company. Therefore, the data transmitted between the client and the server has to be not changed by illegal users. Digital signatures provide this type of threat.
11
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
We should think of that when a new malicious virus that infected the accounting systems of and muddied all the data in the database, turning them into threes. What would the effect of those illegal modifications mean to the company’s business? What reactions would the company obtain to recover the correct data and how would the company even find out the damage? Availability: the system can be only available for authorized users. It is last, but not least, of the three principles. Availability is the lifeblood of any business. If a consumer cannot get to his account to purchase the goods, the business will soon be unsuccessful. In the E-commerce, where every second can in a straight line translate to thousands or millions of pounds in sales, even downtimes of less than an moment can perform huge financial scratch to a company. Think of the quantity of damage done to the company if the company’s Web site became unavailable for some of minutes, which is the period that most sellers used as a benchmark for turnaround time in the Internet. A comedown in business could cost millions of pounds, if it happened. We should consider of those problems: How long could the company continue doing business if the network was damaged? How much money per hour would the company afford if they could not be online?
12
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2.2 The Goals of Security in E-Commerce Security plays a very important function in E-commerce and these goals of security in the commerce process must be to: •
The privacy of the consumer at the point of purchase should be protected.
•
The privacy of the customers’ information while it is stored or processed should be protected.
•
The confidential identity of customers, vendors, and employees should be protected.
•
The company should be protected from waste, fraud and abuse.
•
The information assets of the company should be protected from discovery and disclosure.
•
The integrity of the organization’s information assets should be protected.
•
Guarantee the availability of systems and processes required for consumers to deal with the corporation.
•
Guarantee the availability of systems and processes required for the corporation deal with its vendors and partners. (Russsell et al 2001)
2.3 Secure Web site Guidelines In fact, a secure architecture and design alone does not make a completely secure application. It is only one of the most significant issues, which should be dealing with it to make secure environment. Moroney (2006) demonstrated that is including: •
• •
• •
User input is malicious data: that mean all users are evils until they proven the opposite. Consequently, validate user input should be strongly. The validation code is secure that it verifies input against only allowed values and not invalid values like (--) which is used in SQL injection. Using a string concatenation for creating SQL statements will be disaster: using parameterized statements is safest method as a result the application is not SQL injectable. Output data entered by a user directly on the Web page must be validating and encoding first: The user might enter some scripts, which guide to cross-site scripting vulnerabilities. For that reason, constantly Http Utility should be used. Sensitive data should not be stored in the Web site application even in hidden fields: Hidden fields can be modified simply by just pressing write click and choosing view the source of the web page. Sensitive data should not be stored in view state: View state is just a different hidden field on the Web site, and it can be translated and 13
Mansour H. Almalki
• •
MSc. Internet computer and System Security, 2007
viewed simply. That is happened by using the EnableViewStateMAC=True setting for the Web site. Cookies should be Protected: Always protect the authentication cookies when using forms authentication, and set timeouts as short as possible and only as long as necessary. SSL must be used in E-commerce Web site because, they processes sensitive data and SSL make it more protected. Even image directories or directories with other files not managed by the application directly through SSL should be protected.
2.4 Security Threats Khusial & McKegney (2005) have showed that there are four major players in E-commerce security. The first player is the shopper who uses his computer to login the shopping Web site and purchases items. The second player is the Web site, which is control by a merchant who is selling goods or services on the Web site. The third is the software, which is run the Web site; it is usually developed from third party. The fourth player is the attacker is the player whose try to get information illegality. Figure 2.2 illustrates the players in a shopping experience and the point which attacker can target.
Figure 2.2 Points the attacker can target taken from Khusial & McKegney (2005) The security threads could be one of these points: 2.4.1 Malicious code
It includes viruses, Trojan horses, worms and harmful scripts. These techniques are used by hackers to crack the Web site of companies and be able to disturb or get back sensitive data. 2.4.2 Hacking
Hackers use their skills and discover weaknesses in shopping web sites or the systems to get information and break the trust of companies trading in the B to C environment.
14
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2.4.3 Information Gathering
Information gathering is also a way of compromise merchant Web site transactional or confidential information. This could be done by one of these methods: • Social engineering: The easiest way of attacks. The hacker can compromise and find fault in merchant Web site by just having phone conversations with company by asking simple questions like what database or operating system is used in the company. That will allow the hacker to attack the system or the Web site. •
Rubbish: when the staff or users throw away a paper, CDs, DVDs or hard disk that includes sensitive data.
•
Network sniffing: the hacker monitors the data and network by using special programs. He can get some sensitive data as the consumer details or credit card numbers.
•
Guessing passwords: Another regular attack is to guess a user's password. For instance, some uses use their name as the password. This style of attack could be manual or automated by using particular programs.
•
Phishing: the hacker is tried to obtain sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy merchant Web site. eBay, PayPal and online banks are common targets. It is normally happens by email or instant messaging.
2.4.4 Denial of service attacks (DOS)
When the attacker floods the merchant Web site with useless traffic making the server over load. It is an attempt to make the Web site resource unavailable to its intended users. For E-commerce, this is a very unwanted and more importantly a costly situation. 2.4.5 Internal attacks
It could be come from company staff or the third party provider. We have to think of it as well as the external threats.
Chapter 3 Security and Usage 3.1 Encrypting Sensitive Data in a Database 3.1.1Introduction
Often the E-commerce Web site staffs do not understand the amount of hazard associated with sensitive information within. The database is the main goal for hackers, which they are trying to get into the database. Using technologies such as Secure Sockets Layer (SSL) is to secure transport confidential user information across network connections. However, what we should do about storing the customers' confidential data securely? Even we can not trust in own staff to have access to such confidential information. 15
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
The E-commerce Web site that has customers table is the most important table in the database. This table might have columns like Name, Address, Email, and password. Obviously all of the records and fields in the Customers table are meant to be kept private. That is, while our customers would certainly be wearied if their email address and password was discovered by hackers. Consequently, the worst we might be planed so it should be very hard for hacker to break it. The encrypting and decryption functionality of database is one of the beast solutions to insure that kind of security. (Mitchell 2005) 3.1.2 How It Work
Mitchell (2005) has proved that there are seven steps in order to do the encrypted and decrypted sensitive data to make it in secure way and away from disclosure. These seven steps are: • • • • • •
•
Take the user information in a plain-text input. Encrypt that information. Convert them from a string into a byte array. If we want to read the encrypted data from the database. Convert it from a byte array into a string. Decrypt them. Work with the plain-text data.
More issue in cryptography will discuss in implementation section of this project.
3.2 Avoid SQL Injection Attacks The basic meaning of SQL Injection is that a hacker can put extra SQL statements into the commands, which process at the database. These commands can recover sensitive information from the database. Code that is vulnerable to SQL Injection command strings with external input. 3.2.1 SQL injection techniques
Sharma (2005) illustrated that there are two of the SQL injection techniques are commonly used: 3.2.1.1 Access through Login Page
•
Using ‘or’ condition
To bypass this authorization, the hacker will have to enter the following SQL symbols: Username: Password:
Ram ‘or 1=1 -16
Mansour H. Almalki
Output will be: •
MSc. Internet computer and System Security, 2007
"Logged In SQL world ".
Using ‘having’ clause
Username:
' having 1=1 --
Password:
[Anything]
Output will be: browser contain the
" Error".
And will show error message in the
name of database and attribute name. •
Using multiple queries
Username:
' or 1=1; drop table users; --
Password:
[Anything]
Output will be: Then the query would execute. • Using extended stored procedures
Username:
';exec master..xp_cmdshell ‘iisreset’;--
Password:
[Anything]
Output will be: (stored
This would send a query to SQL Server to execute procedures user or database should have
necessary privileges). 3.2.1.2 Access through URL •
By manipulating the query string in URL
When URL looks like:
www.sqlproduct.com/sqlproducts.asp?p_id=7
The hacker can write: p_id=0%20having%201=1 Output will be: and he could exploit
http://sqlproduct/sqlproducts.asp?
he can get details of SQL server version the vulnerabilities linked with this version
,if the SQL server is not fully patched . •
Using the ‘SELECT & UNION’ statements
For example, this is will happened if returns employee information when a city is entered. The attacker is able to use sysobjects and syscolumns tables to make UNION statement. The table sysobjects for the table names and syscolumns for the fields. The following injection string can be used: ’ UNION ALL SELECT pname,p_id, ‘5’ FROM sysobjects WHERE ptype = ‘U.
3.2.2 To help protect against a SQL Insertion attack: •
All queries should be stored as procedures. The way SQL parameters are passed prevents the use of apostrophes and hyphens in a way that would let an injection attack to happen. In 17
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
addition, it lets database authorizations to be limited to only permition specific procedures to be applied. All user input must then fit into the context of the procedure being called and it is less possible an injection dangerous could happen. •
The length of the form or query string input is limed to 10 characters long and more characters is not allow than that to be input for the value. This will make it more hard to SQL inject damaging SQL statements into the input.
•
Sensitive data like user name, password, address and Email have to be encrypted. Encrypt user input for comparison against the data, which is stored in the database. The data is at this time being compared in a sanitized fashion that has no meaning to the database and avoids the hacker from injecting SQL commands.
•
Using on screen keyboard to input the data and avoid entering by pressing on the keyboard that will make the restriction of characters is more essayer. Avoid dynamic SQL. Execute with Least Privilege: for example, a stored procedure always-return only one row of data will be better than granting the user/role read access overall table.
•
•
Do not display errors to the user that contain all kinds of wonderful hacking information like table names, fields, database drivers, sql statements, etc. Use a custom generic web page in ASP.NET.
•
Validating the input characters, there are at least four steps should be done for input validation: 1. Filter out character like single quote, double quote, slash, back slash, semi colon, extended character like NULL, carry return, new line, etc, in all strings from: Input from users, Parameters, URL and Values from cookie. 2. Make sure numeric fields really look like numbers. 3. Do step 1" and 2" not only on users' direct input, but on all nonconstant variables. 4. Check if the inputs are within your expectation (e.g. 0 < age < 120, login id without space, etc.). (Sharma 2005)
No
Characters
1
SPACE
2
\SPACE
3
\'
4
' 18
Mansour H. Almalki
MSc. Internet computer and System Security, 2007 5
\"
6
"
7
--
8
\-\-
9
\=
10
=
11
\;
12
;
13
\#
14
#
Table 3.1 Characters Using in SQL Code Injection
3.3 On–Screen Keyboard On–Screen Keyboard is a value technology used in the past by Microsoft company to shows a virtual keyboard on the screen that permits users with mobility impairments to type data by using a pointing device or joystick. Besides providing a minimum level of functionality for some people with mobility impairments. Now, there are many companies, banks and E-commerce web site used the on-screen keyboard for security propose. As we know, that spyware and other malicious software can log all key strokes, record keystrokes and steal the user details then sent out to the hackers. Therefore, the sensitive date should be entered via the on-screen keyboard to prevent key strokes logged by spyware when using internet shopping on the Internet.
3.4 Password Security 3.4.1 Introduction
Passwords are mostly like a key that are the way to access an accounts, personal information, software applications, etc. Passwords help to certify that only authorized user to access to the Web site, user accounts and email accounts. Moreover, Strong passwords are an important aspect of Internet and system security. Any user should create strong secure passwords and keep them in a safe and secure way. Therefore, Easy-to-guess passwords could compromise the security and put the secure information at risk. The main problem is that many users use one password for using it in everywhere other problem is using Easy-to-guess passwords so in the next making strong password will be discussing.
19
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
3.4.2 General password construction policies
There are the particular policies that password must be conformed in order to be accepted as a strong password: •
Passwords should not be based on well known as the personal names, address or countries. It is very easy for hackers to guess things like that information.
•
Password length defiantly will increase the security. Passwords should be eight or more characters in length.
•
Random combination of upper-case and lower-case letters and digits should be in the password.
•
Passwords must not contain dictionary and/or foreign words (word found in a English or foreign dictionary).
•
Password should be changed at least every 30 - 60 days and the old passwords should not be re-used for a period of 6 months.
•
Using the same password for different accounts absolutely is a wrong idea.
•
Password should not be reveal over the phone or in an email message. (SANS Institute 2006)
3.5 SSL (Secure Socket Layer protocol) 3.5.1 Introduction
The Secure Socket Layer protocol was created by Netscape in 1994. It is commonly used for topics: to validate the identity of a Web site and to create an encrypted connection for sending credit card and other personal data. Martin (2002) explained that in short how it works: 1.
A browser requests a secure page. It usually start like this https://.
2.
The web sends its public key with its certificate server after receive the requests from the browser.
3.
The browser checks that the certificate it is valid, related to the same site and it was issued by a Certification Authority (like VeriSign).
4.
The browser then uses the public key of the web server to encrypt a random symmetric encryption key and sends it to the web server with the encrypted URL required with other encrypted http data and send it to the web server.
5.
The web server receive the symmetric encryption key and decrypts, by using its private key and uses the symmetric key to decrypt the URL and http data. 20
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
6.
The web server sends back the requested html document and http data encrypted with the symmetric key to the browser.
7.
The browser decrypts the http data and html document using the symmetric key .Now the browser can shows the Web site in secure way.
3.5.2 SSL Certificate
Usually, an SSL Certificate will contain the domain name, company name, address, city, state and country. It will also contain the expiration date of the Certificate and information of the Certification Authority responsible for the issuance of the Certificate. When a browser joins to a web server it will check that it has not expired, contain the write information, it has been issued by a Wright Certification Authority and it is being used by the website for which it has been issued. If any of them is fails, the browser will show a warning to the consumer and allow him to know that the Web site is not secured by SSL. According to VeriSign SSL Certificates enable 128- or 256-bit, which hard to decrypt and it is suitable to over 99.9% of Web site visitors. E-commerce Web sites, which use it, have a strong encryption and give consumer a greater privacy with reduced hazard of fraud and identity theft. There are two general indications of a secured web site: The first one is by checking the web page URL. Usually, the URLs begin with the letters "http". On the other hand, over when using SSL the address comes like this "https". The second way is by checking for the "Lock" icon. There is a "lock" icon wherever in the window of the browser (NOT in the web page display area) for instance, Microsoft Internet Explorer displays the lock icon in the lower right of the browser window as in the figure. When double click on it will show information of the site's security. It is necessary to double chick the icon to know what is contain.
3.5.3 Installing SSL
The steps involved in installing a SSL certificate, therefore enabling SSL to provide security the Web site: •
Purchase SSL Certificate: The first step is to purchase a SSL certificate. There are many companies offering the SSL or EV SSL technology that it might be differ from each other based on brand and features.
•
Generate a CSR(Certificate Signing Request): From the web server that will be SSL enabled, a CSR should generate, saved the CSR to a text file and sent to the provider. For detailed CSR generation instructions based on which brand of web server you are using. On the other hand, 21
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
the provider will generate it if they will be the hosting for the web site. •
Enrol for a SSL server certificate: The merchant should log in to the provider Web site, confirm the domain name is correct and he should enter other information like the address and the contact information.
•
Install the SSL server certificate: Simply that will be paste the CSR text that the provider sent (either through email or downloaded from your SSL.com account) inside the Web site and monitor the certificate status.
3.6 EV SSL (Extended Validation Secure Socket Layer protocol) According to Microsoft Web site Extended Validation SSL Certificates offer high security Web browsers information to obviously identify a Web site’s organizational identity. Extended Validation SSL certificates protect consumers from dealing business with untruthful web merchants. Basically, EV SSL certificates are the new type of certificate that provide exact authentication for a business' identity. Internet Browser recognizes EV certificates for businesses that have completed this process, and visually represents them by colouring the Address Bar in green colour.
Figure 3.2 IE7 Address Bar with EV SSL taken from http://www.microsoft.com/windows/products/winfamily/ie/ev/default.mspx
In addition to changing the Address Bar shading, EV certificates display details about the business, such as location for incorporation and 22
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
country. If customer of Web site, seeing the green Address Bar and the owner and country information that would help him verify the identity of the Web site to decide it is the certainty Web site or not. Moreover, the customer will be certain that information remains secured from strangers. On the other hand, we have to recognize that an older browsers will display Extended Validation SSL Certificates with the same security symbols as existing SSL Certificates.
Figure 3.3 IE7 Address Bar Securities with EV SSL taken from http://www.microsoft.com/windows/products/winfamily/ie/ev/default. mspx
23
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 4 Payment Systems 4.1 Introduction There are two ways for payment in Ecommerce Web site online payment and offline payment.
4.2 Online Payment Methods 4.2.1 Introduction
Online payment method is the easiest and fastest way to receive the cost of orders with sending an automated email including the invoice. The ordering physical products will be shipped only after the payment has been confirmed. There are two categories of on-line payment: 4.2.2 Payment Gateway (Real Time):
Cooper (2002) has confirmed a payment gateway is an online method for processing credit card or other payment transactions in realtime. A payment gateway is normally linked to a merchant account. The payment gateway facilitates the management of communicating a payment transaction between the different payment networks or banks. A payment gateway typically provides extra features for example: online virtual terminal for manually processing transactions, transaction reports and more. 4.2.2.1 Merchant Account
A Merchant Account involves a particular sort of agreement with a bank or clearing house that lets the merchant to accept credit card payments into his Account. The results of any credit card transactions passed through the merchant online authorization company are then, expectantly, credited to the merchant account if the transaction is permitted. A Merchant Account is the most cost effective way of accepting payment by credit card. In addition, using a merchant account with the company who will authorize the payments online led to the ability to accept credit card numbers on the Web site, and then receives any payments due to the price of orders. It is as simple as that.
Online Web site
Payment Gateway
Company
24
Merchant Account
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 4.1 Payment Gateway taken from https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-gatewayoverview-outside&nav=2.0.3 1. The customer enters credit card details on the Online Web site. 2. The Payment Gateway encrypts that information and securely sends it to Merchant Account Company. 3. The transaction is checked for authorization reason. 4. The result is encrypted and sent back via the payment gateway. 5. The customer gets the results and makes a decision if he wants to apply the order or not.
(Pay flow Payment Gateway available on PayPal Web site) There are several steps to get funds from the customer’s credit card and add it to the merchant account, the first is approving the deal and taking the customer's credit card information on the Web site. After that, the card has to be verified and approved, to ensure that it has not been stolen, or has expired. The Merchant Account Company might give this service, or the merchant might decide to use an online authorization company. After the card has passed exact security verify, the merchant account provider or online authorization company then send the information to their credit card processor who debit the customer's credit card and deposit the funds into the merchant account. This sequence of actions obtains between 1 and 3 days for the majority of merchant account providers. Then within frequently three days, the customer's card will be debited and the Merchant Account credited. The Merchant Account Provider will also take a commission of approximately 4% per transaction. In the end, the merchant have to send an invoice via an e-mail immediately to the customer (that will happen automatically). The advantages of using Payment Gateway •
Payment gateway providers do not intrude on the merchant branding.
•
They are invisible to the consumer (the Web side is appeared more professional).
25
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
•
Payment gateway providers offer immediate feedback to the merchant.
•
Payment gateway providers supply an additional professional resolution.
•
The majority of payment gateway providers have strong fraud protection.
•
Money after checking automatically deposited in the merchant bank account.
•
They improve the bookkeeping features.
•
The large company deal in this way. The disadvantages of using Payment Gateway
•
Payment gateway providers are more expensive and involved to sign up / set up.
•
Require a merchant account.
•
Usually require a good credit history.
4.2.3 Payment processors (Delayed Response)
The alternative way to have merchant account is payment processors when there are many companies provide this serves one of the most famous is PayPal. 4.2.3.1 PayPal
PayPal take place from the popularity of eBay Web site auctions, then it is quickly becoming an incredibly accepted payment option in payment processors world. The PayPal solution allows customers to shop on the Merchant Web site then make payment at the PayPal website with a credit card, when the transaction is completed, they are returned to the merchant Web site. Merchant Web site
PayPal web site
Merchant
Web site
Figure 4.2 PayPal Gateway taken from https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-prooverview-outside 26
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
PayPal Web site show that the most important issue for make papal well known is low cost of entry into E-commerce. It costs nothing for the merchant to setup a PayPal account and they have very reasonable processing fees of 1.1% to 2.4% + £0.30 for each transaction. Putting the PayPal name on the merchant’s websites can lend credibility to those online activities, which is significant when attracting consumers that might be hesitant to purchase from the internet. Now, PayPal lifted its condition for consumers to have a PayPal account, thus removing another barrier to new consumers that might not have understood or wanted to open a PayPal account just to make a purchase. PayPal is required only a bank account to deposit funds which is received from consumer. It does not require an online merchant account to receive payment by credit card. More over PayPal permits consumer to use bank accounts for payments further the main credit cards. On the other hand, PayPal offers limited fraud protection for both merchant and consumer. However, that It is not prevented PayPal to become a most important choice for businesses. The advantages of using payment processors. •
Less expensive and involved to sign up / set up.
•
Do not require a merchant account.
•
Usually do not require a good credit history. The disadvantages of using payment processors.
•
Payment processors providers intrude on the merchant branding.
•
Payment processors providers are visible to the customer.
•
They are offered delayed feedback.
•
Provide a less professional solution.
•
They do not always make automatic deposits, which is very strong problems.
•
Offer more disjoined record bookkeeping.
•
The small company deal in this way.
4.3 Offline Payment Systems Offline payment is one of the available payment methods to customers should the merchant choose to support it. Offline payment refers to payments that need manual processing. For instance, it can apply to the customer who is uncomfortable submitting a credit card number on the internet and chooses Cash On Delivery option, as well as the customer who submits credit card details where there is no supporting set up with a bank for automatic agreement. On the other hand, offline payment processing can take a long time comparatively (2-5 days) it can also increase the cost of doing business for the merchant. 27
Mansour H. Almalki
MSc. Internet computer and System Security, 2007 (WebSphere Commerce Information Centre 2005)
Chapter 5 Literature Review 5.1 introductions This is important chapters of the documentation. Literature review demonstrates the effort has devoted in dissertation about selected an idea and creates of understanding different existing systems. Shopping Web site based multimedia emailing system is not very new concept and many of them are in market. Some of them are freeware though others can bought by professional company. It would be hard to see all shopping Web site in the Internet but the famous of them will be studied and presented according to (www.vouchercodes.com) Web site.
5.2 Boots Boots is one of the best-known retail names in the UK providing health, beauty, baby, fitness and other products (www.boots.com). They provide Boots discount vouchers, online discounts and free delivery on Boots website all this things increase the consumer to visit the web site either they go to visit them shop. Unfortunately they use the old SSL version, it soups suppose to be EV SSL also they do not accept payment by payment processors for those people who do not want to use their credit card every time in the Internet. Finally, there are no password policies that mean the user can put a weak password and the system will accept it. Even they accept six characters for password, which suppose to be eight.
5.3 Dixons Dixons is now completely online (www.dixonos.co.uk). Dixons UK is now an online shop only and offers great value across the total range. Dixons electrical has been in the market now for over 73 years and prides itself on great brands at great prices. They use the last security technology even EV SSL. The disadvantage is that the password has six characters long without any password policies. Moreover, the Company do not accept payment by Payment processors.
28
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
5.4 Flowers direct Flowers direct (flowersdirect.co.uk). Flowers direct flower delivery service to anywhere in the UK at your fingertips. Flowers direct offer delivery flowers at great value, but most importantly all flowers are excellent quality with fast and reliable next day flower delivery service. The Company accept payment by Payment processors and that is good. On the other hand, it do not use be EV SSL. The disaster policy is the user can used only one character as a password.
In the next chapters, the Business to Consumer issues is discussed in detail. That will include building a shopping Web site to illuminate aim from the dissertation with the last technology which used in the market.
Chapter 6 Work Plan 6.1 Time Table Before initiation of the implementation for the project, tasks and scheduling to each task should be determined. This process is known as project work plan. In this part, it has to decide about task and allocate time according to its complexity and length. Task Name
Start Date 29
Finish Date
Mansour H. Almalki
1
MSc. Internet computer and System Security, 2007
Planning Phase Project Initiation
03/09/07
06/09/07
Back ground study
07/09/07
13/09/07
Feasibility Study
14/09/07
19/09/07
Project Work Plan
20/09/07
24/09/07
Requirement Analysis
26/09/07
28/09/07
Requirements
01/10/07
03/10/07
Requirement
04/10/07
08/10/07
Use cases
09/10/07
11/10/07
Sequence diagrams
12/10/07
16/10/07
Class diagram
17/10/07
19/10/07
22/10/07
24/10/07
Encryption and decryption
25/10/07
29/10/07
Literature review
30/10/07
02/11/07
Database design
05/11/07
09/11/07
Interface design
12/11/07
15/11/07
Program specifications
16/11/07
22/11/07
Functional Identification Non-functional Identification 2
Analysis Phase
Security keyboard)
3
4
aspects
(screen
Design Phase
Implementation Phase Security aspects development
23/11/07
30/11/07
Program development
03/12/07
18/12/07
Program testing and evaluation
20/12/07
25/12/07
Documentation
26/12/07
04/01/08
Project Submission
07/01/08
11/01/08
Table 6.1 Time Table
30
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 7 Methodology 7.1 Introduction It is not core requirement of this documentation and project to discuss about methodology chosen for development of this project. However, no project can ever achieve success if it does not carried out according to some predefine pattern and rules. These patterns and rules are known as methodology. Because of nature of each project is different for other, some projects are of same nature that is why they can be built according to same type of methodology while others might be done by completely different way of methodology.
Ways to carryout a task is known as methodology. These are some predefined rules which have to be follow in order to carryout successful completion of any project. Many methodologies have been developed, discussed and implemented in different projects. Each got there pros and corns. In addition, each project is of different nature and that is why some completely settle themselves in certain methodologies while they would become failed projects if they have been assigned unmatched methodologies. There are many ways to do methodology as prototyping, code and fix model, spiral model and water fall model which has been chose in this application.
7.2 Water Fall Model Parekh (2005) has illustrated that water fall model is one of the pioneer in field of methodologies. It has been evolved over time and it become base for development of other methodologies. Important aspects of this life cycle model are given below: 1. It is top-to-down life cycle model in which back tracking of moving back to any previous stage is prohibited. 2. Requirement of project should be known before start of project. 31
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
3. Requirements should not be change over time because changes are permissible. 4. All stages are completed as one by one in sequential way. 5. Project completes on time as new requirements are not allowed and designer can consistently decide about time to spend upon each stage. 6. It is consider as rigid methodology as it does not gives any flexibility, but still it has given many successful projects.
Figurer 7.1 Water Fall Model taken from Parekh (2005)
32
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 8 System Analysis 8.1 Introduction Requirements gathering of a project are one of the most difficult and important tasks which have to done because it would be desirable to gather all requirements before the start of project. Requirement that appear on later stage would cause delay and complexity in project. If information has achieved about core requirements then it would be easier to initiate and carryon project development.
8.2 Requirements Gathering According to Mochal (2001) requirements gathering are the process of understanding the consumer needs and expectations from a planned system or application. There are many methods for gathering requirements of any project. All of these have advantages and disadvantages. Therefore, it is a good idea if two or more of them have been done: •
Interview.
•
Questionnaires.
•
Task analysis.
It would be time driven process to carry out all techniques of requirement gathering. It would also take more time to present their output in documentation. Thus by considering time, availability and easiness following two has been chosen for gathering requirements.
8.3 Interview It is one of the most prominent and simple to use way of gathering requirements. Some experts believe it to be the best because it encourages a direct communication with user of system and designer. This sort of method gives designer a good chance to better understand actual requirements of user of system. Direct communication also encourages users to give their point of view. 33
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
There are some negative aspects of interview method. One of them is cost, it would be quite costly if more users have to be interview and also more time has to spend for each interview and such method become even more difficult if more users have to be interviewed. In addition, the whole Interview, which have made with its results is available on appendix B.
8.4 Questionnaires It is also one the most popular form of getting information. It is subjected to larger number of users and made it possible to get important information from them. It is not as effective as interview but still it provide sufficient information, which would become vital in the development of any project. A formal questionnaires session have been conducted. Main purpose of them was to gather user’s general point of view about purpose system. In addition, the whole questionnaires, which have made with its results is available on appendix C.
8.5 Task Analysis Task
analysis
is
an
efficient
technique
of
gathering
requirements for new system and to know exact functionality of old system. Task analysis is based upon a diagram which shows a hierarchy of tasks and corresponding sub-tasks. These tasks and sub-tasks represent functionalities of system have to be done in order to achieve systems objective. Below is a task analysis diagram of current system.
34
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Mansoor Shopping Center 0
Admin Registration 1.1
Add Admin Information 1.1.1
Administrator 1
Customer 2
Admin Login 1.2
Category 1.3
Update / Delete Admin Information 1.1.2
Customer Registration 2.1
Add Customer Information 2.1.1
Generate Login Session 1.2.1
Payment By Card 2.4.1
Item 1.4
Add Category 1.3.1
Customer Login 2.2
Update / Delete Customer Information 2.1.2
Logout 3
Update / Delete Category 1.3.2
Cart 2.3
Report 1.5
Add Item 1.4.1
Checkout 2.4
Generate Login Session 2.2.1
Add Items to Cart 2.3.1
Payment By Pay Pal 2.4.2
Update / Delete Item 1.4.2
Report 2.5
Update / Delete Items from Cart 2.3.2
Payment By Cheque 2.4.3
Figure 8.1 Task Analysis
Task which is at the top of this diagram known as “Mansour Shopping Centre” represents the whole system. All tasks below it are the main set of functionalities that suppose to be supported by this system. Descriptions of all prominent tasks are given below:
35
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
8.5.1 Admin Registration
Administrator of this system must register itself before its functionality. In registration, system would ask administrator personal information with login details that administrator likes to have. If this information is correct then system register administrator with it and now administrator can use system’s functionalities. Administrator can also update registration information. 8.5.2 Admin Login
Registered administrator can use different functionalities of system after login to it. To login to system user has to provide its ID and Password. This login information then verified from information already stored in database. If provided information is correct then user login to system otherwise administrator will receive an error message. 8.5.3 Category
Items are held or recognize under general categories. These categories can be added, removed or updated by administrator of system. 8.5.4 Item
Items are the one of the main component of system. Items are the product for sale and customer are interested in them. Items can be more
than
one
and
are
directly
comes
under
some
category.
Administrator of system can add, remove or update any item. 8.5.5 Report
Both administrator and customer require report from the system according to transactions made by them. These reports can be general purpose or specific purpose depends upon needs. Administrator needs report according to category or customer. While customer requires reports according to purchased item or according to purchased date, these reports can be printable. 8.5.6 Cart
Registered customer can login to system and browse available items. If they like any item or group of items, they can add them to the cart. Cart is a place which list down all the items selected by customer 36
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
and intended to purchase. A customer is an administrator of cart and can add or remove items from cart. 8.5.7 Checkout
If customer has done its shopping then customer requires to checkout. In checkout process customer is expected to pay for selected items in cart. System will show all selected items and total amount of money required to purchase them. System will also provide customer three ways of payment. Customer will select one of the payment method and pay for the chosen items.
Chapter 9 System Design 9.1 Introduction After system analysis there should be a way to represent analysis output to either user or system programmer. The method in which system designer presents its analysis and finding is known as System Design. It is also one of the most important outputs that are required to see before start of implementation process. System design has to be accomplished in
37
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
number of steps and techniques. In this project, most prominent and well used designing technique has been followed and these are:
9.2 Use Case Diagrams Chitnis et al (2007) have confirmed that use case diagram comes under the heading of behaviour modelling. It shows an interaction between components of system and their respective users. In use case diagrams there are two most prominent components that are compulsory in making of development of diagrams and these are
Figure 9.1 Use Case Diagrams After analysis of that system, two primary actors and many process components have been found. Interaction between actors and process components has been presented in two forms in section below. One represent whole of system actors, process components and their relationships. While others represent individual components with detailed interaction
between
system
actors
and
corresponding
boundary
shows
completely
component
processes. 9.2.1 System Boundary
System
processes, actors and their interaction.
38
set
of
component
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 9.2 System Boundary Diagram 9.2.2 Registration
Figure 9.3 Registration diagram Description: Register customer with the system so they can start buying items from portal. Triggers: Need of user to register with system.
39
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Inputs: 1. User registration information 2. Preferred Login ID and Password Outputs: 1. User registered to system 2. Or, error message Activities: User provides registration information and preferred login information. System will check whether such login id already exists or not and whether the password and login id are of correct form. If all information are correct then system encrypt registration information and gives user success message. Otherwise, system gives error message. 9.2.3 Login
Figure 9.4 Login Diagram Description: Register user wants to login to system to use its services. Triggers: Need of user to login into system. Inputs: 1. Login ID 2. Password Outputs: 40
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
1. Welcome to system 2. Or, error message Activities: User
provides
login
information
with
screen
keyboard
provided. Information will be compared with information, which is stored in encrypted form into system. Encryption and decryption both functions will be used to make information comparable. If information is correct then user login to the system else user receive an error message. 9.2.4 Category
Figure 9.5 Category Diagram
Description: Administrator alters item categories by adding, removing or updating them. Triggers: Need of management of item categories. Inputs: 1. Item category information 2. Management instruction Outputs:
Administrator
1. Operation carried out
41
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2. Or, error message Activities: Administrator enters or select item category and then give an instruction from a set of instructions like add, remove or update. System will validate instruction and item category and if all of these inputs are valid then system will carryout instruction. Otherwise an error message will be given to user. 9.2.5 Item
Figure 9.6 Item Diagram
Description: Administrator alters items status by adding, removing or updating them. Triggers: Need of management of items. Inputs: 1. Item information 2. Management instruction Outputs: 1. Operation carried out 2. Or, error message Activities: 42
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Administrator enters or select item and then give an instruction from a set of instructions like add, remove or update. System will validate instruction and item and if all of these inputs are valid then system will carryout instruction. Otherwise, an error message will be given to user. 9.2.6 Cart
Figure 9.7 Cart Diagram Description: Customer alters shopping cart status by adding or removing selected items. Triggers: Need of management of items in shopping cart. Inputs: 1. Cart and item information 2. Cart management instruction Outputs: 1. Operation carried out 2. Or, error message Activities: Customer review cart and shopping items, that have been selected and also other available items. The customer select item and give an instruction from a set of instructions like add, remove or update. 43
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
System will validate instruction and item selected and if all of these inputs are valid then system will carry out instruction. Otherwise, an error message will be given to customer. 9.2.7 Checkout
Figure 9.8 Checkout Diagram Description: Customer has done its shopping and now checkout from system by paying for selected items.
Triggers: Need of checkout after shopping. Inputs: 1. Selected items list 2. Selection of payment method 3. Payment Outputs: 1. Operation carried out 2. Acknowledgement of amount and shipping date 3. Or, error message Activities: Customer completes its shopping by selecting all desired items. Then customer selects checkout option. System will give customer 44
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
three options or three modes of payment. User will select one of them and then pay money accordingly. System will gives acknowledgement to user. If these things do not happen accordingly, then system will prompt error message. 9.2.8 Administration Report
Figure 9.9 Administration Report Diagram Description: System generates report for administrator either according to item category or by customer. Triggers: Need of generation of report for administrator. Inputs: 1. Administration reporting option 2. Reporting criteria (either by category or by customer) Outputs: 1. Operation
carried
out
and
reported
generated
for
administrator 2. Or, error message Activities: Administrator selects reporting option and also mode of report (either by category or by customer). If all selections or inputs are valid then system will generate report for administrator. Otherwise, system will display an error message. 45
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
9.2.9 Customer Report
Figure 9.10 Customer Report Diagram Description: System generates report for customer either according to item that customer purchased or according to date of items purchased. Triggers: Need of generation of report for customer. Inputs: 1. Customer reporting option 2. Reporting criteria (either by specific item or by date of items purchased) Outputs: 1. Operation carried out and reported generated for customer 2. Or, error message Activities: Customer selects reporting option and also mode of report (either by item or by date of items purchased). If all selections or inputs are valid then system will generate report for customer. Otherwise, system will display an error message. 9.2.10 Logout
46
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 9.11 Logout Diagram Description: User wants to logout from system and release session and all other resources. Triggers: Need to logout from system. Inputs: 1. User logout option Outputs: 1. User logged out 2. Session expired 3. Personal information removed from platform
Activities: Customer selects logout option to stop usage of services of system for the time being. User session will expire and all resources occupied by user will release. User personal information will be removed from utilizing platform.
47
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
9.3 Class Diagram Class diagram represents different class that has been identified during analysis process. It also shows relationship between classes. Class diagram for this project has been shown below: Perso n
1..*
-PersonID: string -Passw ord: string +T itle: string +F irst N am:estring +Last N a m :estring -R ole: string +R e gistratio()n +U p date In form ation () 0..* +Login/Log out() 1
1..* 0..*C u s to m er
A d m in istrato r -Privilag es +Ad d/R em ove /U p date C ate gory () +Ad d/R em ove /U p date Item () +Ge nerate R ep()ort
-Privilage s +M ana ge C hart () +Ad d/R em ove Ite m ()s +C he ckout () +Pa ym e nt ()
1..* R ep o rt -R e portin g Ele m ent : lo ng -T ype: string +Gene ra te R eport () +Prin t R e port ()
1
1
1
1..* 1..* Ite m C a te g o ry -C atID: long -N am e: string -Price: string +AddC ate gory () +D ele teC atego()ry +U pda teC atego()ry
1
1..*
-Item ID: long -C ateg ory : strin g -D ateOF M an ufacturin : string g -D ateo fSell +Ad dItem() +D eleteIte (m) +U pd ateItem () +Se llIT e m ()
1..* Pay men t M eth o d -M eth odID: long -T ype: string -N a m e: strin g +PayBills()
Figure 9.12 Class Diagram
Chapter 10 Implementation 10.1 Introduction Software development life cycle model of this project is water fall. Therefore, the next stage of development of this project is implementation of project. This is one of the most important stages and customer of this project would be more interested in this stage than any other. Whole of the previous analysis and design activity leads toward this important 48
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
stage. Implementation of project does not composed of only coding of system. As it is the most critical stage of project development, so many important decisions have to be made on this point. It would be difficult to discuss all of them in this documentation. But few critical aspects have been discussed in section below.
10.2 System Mode Any project can be developed in two modes and these are either console based application mode or web based mode. Both of them got their own powers and weaknesses and choice of any of them depends upon the type and demand of project. Before selection of system mode it would be necessary to give brief overview of both of them.
10.2.1 Console Based Application
Console based applications are such applications which normally available on disks or internet website. They came in an installation form. Once they installed on a system then they will become a part of it and they do not required to install again upon usage after first installation. Users are quite familiar with such sort of systems and they do not require constant help or guidance of usage from developers. Normally such applications come with helping contents which are guidelines to use the system. These applications are quick and consistent because they installed on user system and they do not need to download interface on each transaction. They applications do not need constant internet connections to carryout there task or to start up a system. But on some critical occasions they need internet connection to collect live information. Along with many advantages there are some disadvantages of console based applications which sometime hurts their popularity. These are as follow 1. Console based applications require constant upgrades and maintenance and they are not easily available. Vender of such application publishes them on disks or either places them on websites. But user has to manually download these updates or patches and install them. Their installation is not automatic in most cases. 2. If they have to present information from website. Then they would become useless without internet availability. 3. They are expensive. 49
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
4. Sometime they are complex when they built for a specific purpose.
10.2.2 Web Based Application
Web based application are those application which are available on internet. They do not require any installation. They work like any general website and serve the purpose of organization that requires it for their specific purpose. As a website does not requires any installer then it is also not require for a website to be installed on computer. Website consists of web pages which express information which an organization wants to deliver to its user. There are also some other interactive pages which request user to input any information required by system and then reply back with results accordingly. Web base applications are easier for user to work on, to browse information, and to send information. Users are quite familiar with format of websites and they prefer to browse information on them because they are now become a common tool. Along with many advantages of web base application there are some disadvantages which might affect its popularity and these are: 1. Web based applications are completely useless with internet and they can not provide anything if a system does not have an internet connection. 2. Web based applications are slow because on each transaction a computer needs to download not only the data but also the interface. 3. Its speed also depends upon complexity of each transaction and internet speed.
10.2.3 Chosen Mode of Application
Web base application mode has been selected because this is an online shopping system and it does not require user to install this application on their system. Application should be available on all places. Business has to made and run on internet as this is a prime demand of online business systems. This organization does not want their users to upgrade system and it requires thing to change on one (server) end. All other users are only required to use this portal and they should not be worried about any upgrades or patches.
50
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
10.3 Programming Language 10.3.3 ASP.NET
According ASP.NET Web site ASP.NET was a pioneer dynamic web development language. That language has opened a new horizon of ways of transferring information from internet. That language has made it possible for many organizations to handle their businesses through internet and increase their income circle and customers through out the world. ASP.NET is an extension of ASP which includes all the basic features provided by Asp along with some new astonishing functionality. This language is also considered as one of the most advanced and matured programming language. Many websites have been developed in it. This language also has a great set of libraries which poses solution of every problem. This language make life of programmer quite easier because programmer does not need to seek helps from different other sources. The helping section of this programming language is called MSDN. This helping program ask programmer to insert searching keyword, after this the helping program find relative information from not only the locally store information but also from all other prominent forums and websites. Else then the helping program there are thousands of other forums and developer portals which can give advice on problem of any complex nature. This language is quite easier to learn. An average programmer needs nearly one month to became more than average programmer in this development language. As this language assist programmer during development process, so programmers do not need to memorize each syntax and programming routine. ASP.NET came with an excellent development tool known as Visual Studios.NET. This development tool is quite easy and helpful. It assist programmer in development of program of any complex nature. A programmer can develop its program quite quickly in this development environment. After careful consideration of situation and needs of application, it has been decided to use ASP.NET 2.0 for the development of this program. Choice of this language has been made because of many facts which includes: 1. Author does not have much time to learn any new language as author got a good hand in chosen language. 2. Author does not have much time to complete this task and this language promise a quick development of any solution.
51
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
3. Author finds it easier to develop and deploy its solution in this programming language.
10.4 Database Management System 10.4.1 Introduction
This project requires usage of any more than average database management system. Like programming languages there are many database management systems that author can choose for this project. Every database management system got its own positive and negative points but each of them serves the purpose of storage and retrieval of information. Author has chosen SQL Server as a database management system for this project because ASP.NET and SQL Server has been manufactured by same company. They both support each other and Asp has many built in routines which made connection to database easier and efficient. Retrieval of information is straight forward and dataset objects made it possible to store result of query and then use it without connecting to database again. SQL Server can store large amount of information and searching mechanism of SQL-Server is far more advance and good.
10.4.2 Coding
Implementation of project is composed of set code which carryout certain task. There are few coding conventions which are universal and should be followed by each development team in order to make their project more versatile and acceptable. If a development team follows coding conventions and rules then if they are not able to develop certain functionality at the present, then those functions can be develop later on by other development team. It would be rather easier for other developers to understand and extend existing code. Else then coding conventions and ways of development of programming functions, this section also includes important coding chunks which are vital or the main driver of this program.
52
Mansour H. Almalki
•
MSc. Internet computer and System Security, 2007
Encryption Function To implement encryption function a key has been made and saves in the
database and only administrator of system can make and save that key. A Hash function format of that key is MD5. In the field of MD5 (Message Digest Algorithm 5) is well known and most used hash function. It is composed of 128 bits hashed value. MD5 is mostly used in different form of security applications. The main cryptographic technique that has been used in this system is (3DES). TripleDes is known (Triple Data Encryption Algorithm) which used hashed key in MD5 format and Administrator provided information to be encrypted. Then with these parameters encryption function encrypt the information and provide this information to other functions so that they can save it in database. Triple Des is composed of 168 bits storage length and it is one of the most secured and recommended form of encryption. Code below shows the general encryption function used for this program that has shown by Stallings (2003).
Protected Function EncryptFunction(ByVal toEncrypt As String) Dim keyArray() As Byte = fetchKey() Dim UTF8Encoding.UTF8.GetBytes(toEncrypt)
toEncryptArray()
As
Byte
=
Dim tdes As New TripleDESCryptoServiceProvider tdes.Key = keyArray tdes.Mode = CipherMode.ECB tdes.Padding = PaddingMode.PKCS7 Dim cTransform As ICryptoTransform cTransform = tdes.CreateEncryptor() Dim resultArray() As Byte cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length)
=
tdes.Clear() EncryptFunction = Convert.ToBase64String(resultArray, 0, resultArray.Length) End Function
The fetch key function collects encrypted key from database and provide it to encryption function for use. 53
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Protected Function fetchKey() Dim myConnection As SqlConnection Dim myReader As SqlDataReader Dim myCommand As SqlCommand Dim key() As Byte = {11} myConnection = New SqlConnection("Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=cryptography;Data Source=MEHBOOB\SQLEXPRESS") Try myCommand = New SqlCommand("select * from CrytoKey",
myConnection)
myConnection.Open() myReader = myCommand.ExecuteReader() If myReader.HasRows Then myReader.Read() key = myReader("SecretKey") End If myConnection.Close() Catch ex As Exception End Try fetchKey = key End Function
•
Decryption Function Decryption function required a parameter which is composed of a value that
needs to be decrypted. Encryption function fetch encrypted key from database and then with that key decryption function decrypts encrypted parameter and returns a human readable (alphanumeric) value. Code below shows all steps that need to decrypt a value.
Protected Function DecryptFunction(ByVal cipherString As String) Dim keyArray() As Byte = fetchKey() Dim Convert.FromBase64String(cipherString)
toEncryptArray()
Dim tdes As New TripleDESCryptoServiceProvider
54
As
Byte
=
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
tdes.Key = keyArray tdes.Mode = CipherMode.ECB tdes.Padding = PaddingMode.PKCS7 Dim cTransform As ICryptoTransform cTransform = tdes.CreateDecryptor() Dim resultArray() As Byte cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length)
=
tdes.Clear() DecryptFunction = UTF8Encoding.UTF8.GetString(resultArray) End Function
•
Screen Keyboard This keyboard has been provided to increase security of this system. Sometime
hacker of intruders read combination of keyboard and figure out data input by user. That data can be quite useful and important and it might compose of user name, password and date of birth etc. Security is one of the prime requirements of this website so it is decided to make a screen keyboard which would reduce the impact of hacking and make this system more secure. Code below shows only few important aspects of screen keyboards as it is not possible to elaborate everything here.
function addCharacter(ch){ document.frmTyping.CtrTextfield.value
=
document.frmTyping.CtrTextfield.value+ch; } function addAlphaCharacter(ch){ document.frmTyping.CtrTextfield.value document.frmTyping.CtrTextfield.value+document.getElementById(ch).innerHTML; }
function clearField(){ document.frmTyping.CtrTextfield.value = ''; }
55
=
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
function backSpace(){
fieldValue = document.frmTyping.CtrTextfield.value document.frmTyping.CtrTextfield.value = "";
for(var z=0;z
=
document.frmTyping.CtrTextfield.value + fieldValue.charAt(z); } }
These are few general-purpose functions, which deal with click events of user on screen keyboard. Normally this keyboard works just like a normal keyboard that user got as a peripheral device with its computer. User has to select keys from onscreen keyboard with mouse or touch pad rather than typing it.
10.4.3 Project Interface with Description
It is a big program and it would be very difficult to draw and explain each screen. However, in the section below few important interfaces of system has been illustrated and discussed. This section would be helpful for new users who do not know much about system and this section will serve as an introduction to interface of this project. •
Login This is a main page where a user can login to the system if it has valid login
information comprising of valid login and password. If user enters a valid login information then system will log user in otherwise system will display alternative message.
56
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.1 Login Form
•
Onscreen Keyboard This is an onscreen keyboard which has been made for security reasons and
main purpose of this page is to reduce amount of attack and threats to this system because many hacker try to hack keyboard key and attain valuable information. This control can be called from different pages. On the other hand, functionality of this control is similar wherever it is being used.
57
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.2 Onscreen Keyboard Form
•
Adding New Category Category is like a general name for group of object or items which shows
similar behaviors. Categories are also names of group of brands from different companies. For example, watch is a category while SWISS watches, RADO watches or SEIKO watches are the names of brands under category watch. This page let user (administrator) to define new category.
58
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.3 Adding New Category Form
•
View and Update Categories This page will display all categories currently handled by this website. User
(administrator) will be able to view details of already added category. There is also one like against each category and it is named as “update”. From this like a user can update information any category.
59
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.4 View and Update Categories Form
•
Add New Item This is a page where an administrator can add a new item against any
category. This item will then be available for customer to purchase. To add a category, administrator has to provide item title, description, price, type of category, two picture (big and small) which will be display against category and customer can see it and quanity of item.
60
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.5 Add New Item Form
•
Add Item to Cart This page will be visible in customer login. A customer can view information
regarding any item in particular category. Customer can see items pictures and it quantity. Customer can then add item to its cart. Customer will be able to view its cart all the time while doing its shopping.
61
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.6 Add Item to Cart Form
•
Checkout Customer after done its shopping can select checkout option. In checkout page
a customer can see all items in cart and their total price. Customer can also remove any item if it does not require. This page also contains three further options of payment which are payment by card, by bank draft or by cheaque. Customer must has to select any one of them and pay for its shopping.
62
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.7 Checkout Form
•
Report Customer and administrator both are interested in this section. Report that will
be represented in this section shows customer purchasing history. This page shows all the items that customer has purchased from this website.
63
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.8 Report Form
Chapter 11 Testing 11.1 Introduction Once a project has been developed it is required to test it thoroughly to ensure that it is giving up most output. Testing of system is a big task and requires careful designing of test with proper execution of testing process. It is a long a process and requires patience, expertise to cater out delay and gather all required information. In process of testing all important and prominent aspects has been tested and well evaluated. Results of these testing were satisfying and give development team more confidence to carry on good work. 64
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
11.2 Test Plan Test plan is a formal testing activity for the validity of any system. For this purpose project team has to develop several test plans according to certain important areas which require careful review of users. These test plans have been developed and executed. Their numbers are quite high and it would not be a nice idea to explain all of them in this documentation. Therefore, only few has been chosen and represented for the sake of clarity and conciseness. All test paln will be available on the appendix.
Chapter 12 Conclusion 12.1 Introduction I try my best to make this project as exist real project which can any company use it as Business to Consumer Web site including all security mechanism that I learnt at Bradford University or my experience on my life. However, the main purpose of this project was to learn understand the new security knowledge that use in E-commerce and what the newest of it. This project is given a valuable knowledge of initiation of project, understanding the requirements, making analysis, design, implementation, testing, and documentation. Understanding and experience in all these features are fundamental for any business Web site to start and develop a successful career. Along with some personal gains with the third party provider (Godaddy Company www.godaddy.com ), the author make a deal with this company to host the Web site and
65
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
make a SSL certificate to understand that technology virtually. In addition, how different types of security system, which the third parties can, provides.
12.2 Critical Assessment How do you like to shop? Do you prefer shopping in the Internet? If yes, do you use your credit card or third party for payment, if no is the security, which offered by the shopping Web site not enough. There are millions of consumers on the Internet and the big issue for them is how they can pay in securely and how they do not be in incurrence of fraud. Sometimes it is a consumer fault, as he does not take care of logoff from the Web site. On the other hand, it could be a company fault when they do not Use SSL.
This project has appeared to cover
completely that argument.
12.2 What have been done Project of business to consumer’s Web site that is sold electronic equipments. Three Web sites have taken as an example Boots, Dixons and Flowers direct. Moreover, the security advantage and disadvantage has been taking as well as the new security standards in the market. However, this Web site includes sort of security mechanisms as follows: • •
• • •
•
SSL certificate. Encryption the sensitive database. Avoid SQL injection attack. On-Screen Keyboard. Password policies. Session security.
66
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
References Norris, M. and West, S. 2001 EBusiness Essentials. John Wiley & Sons Ltd, England Turban, E., Cohen, C., Copi, I. M. and King, D. R. 2003 Introduction to E-Commerce. Pearson Education, NJ, USA Moroney, L. and MacDonald, M. 2006 Pro ASP.NET 2.0 in VB 2005, Special Edition (Pro), Apress, Berkely, CA, USA SQL Injection Techniques & Countermeasures by Pankaj Sharma www.cert.org.in/knowledgebase/whitepapers/ciwp-2005-06.pdf Rajput, E. 2000, E-Commerce Systems Architecture and Applications. Artech House, Norwood, USA Khusial, D. and McKegney, R. 2005 E-Commerce security: Attacks and preventive strategies http://www.ibm.com/developerworks/websphere/library/techarticles/0504_ mckegney/0504_mckegney.html#author Sharma, P. 2005 SQL Injection Techniques & Countermeasures, available on www.cert.org.in/knowledgebase/whitepapers/ciwp-2005-06.pdf SANS Institute. 2006 Password Policy, available on www.sans.org/resources/policies/Password_Policy.pdf Martin, F. 2002 SSL Certificates HOW TO, available on http://tldp.org/HOWTO/SSL-Certificates-HOWTO/x64.html VeriSign, available on http://www.verisign.com/ssl/ssl-informationcenter/strongest-ssl-encryption/ EV SSL, availbal on http://www.microsoft.com/windows/products/winfamily/ie/ev/default.mspx
Cooper, p. 2002 Merchant Account Tutorial available on http://www.findmerchant.com/merchant/merchant_tuto5.htm PayPal. Payflow Payment Gateway available on https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-gateway67
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
overview-outside WebSphere Commerce Information Center 2005 Offline payment cassettes available on http://publib.boulder.ibm.com/infocenter/wchelp/v5r6m1/index.jsp?topic= /com.ibm.commerce.payments.developer.doc/concepts/cpyofflp.htm Mitchell, S. 2005 Encrypting Sensitive Data in a Database available on http://aspnet.4guysfromrolla.com/articles/081705-1.aspx Parekh, N. 2005, The Waterfall Model Explained available on http://www.buzzle.com/editorials/1-5-2005-63768.asp Mochal,T. 2001, Gathering business requirements available on http://articles.techrepublic.com.com/5100-22-1045549.html Chitnis, M., Tiwari,P. and Ananthamurthy,A., 2007 Creating Use Case Diagrams available on http://www.developer.com/design/article.php/2109801
,
ASP.NET available on http://www.asp.net/ Stallings, W.,2007 Network Security Essentials: Applications and Standards, Third edition, Prentice Hall Pay flow Payment Gateway available on PayPal Web site available on https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-gateway-
overviewoutside&nav=2.0.3 Free Online Voucher Codes, Free Discount Codes, Free Coupons & Free Promotional Codes available on www.vouchercodes.com.
68
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
APPENDICES Appendix A Test plan
Test Plan No. 1 Program:
Customer
Version number: 5.1
Registration Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify Encryption Function Objective: Ensure that Encryption function works properly Program
Field
Values
Customer Registration
Registration ID
Blank
Customer Registration
Registration ID
ABC
Customer Registration
Registration ID
123
Customer Registration
Registration ID
#####
Customer Registration
Registration ID
Binary
encrypted
value
according to key Expected results: It is expected that ‘Binary encrypted value according to key’ is valid (because this is one of core security requirements of this system is to produce and save encrypted registration information)
69
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 1
Test Plan No. 2 Program: Login
Version number: 5.1
Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify Decryption Function Objective: Ensure that Decryption function works properly
Program
Field
Values
Login
Password
Blank
Login
Password
#####
Login
Password
123
Login
Password
Binary
encrypted
according to key Login
Password
70
Mansoor123
value
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Expected results: It is expected that ‘Mansoor123’ is valid (because it is the same value which user has provided to system and system encrypt it and save in database, it also correct because it fulfil the criteria of password which should be more than six characters)
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 2
Test Plan No. 3
Program: Screen Keyboard
Version number: 5.1
Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify Screen Keyboard Objective: Ensure that screen keyboard work properly without any error
Program
Field
Values
Screen Keyboard
Input Field
Blank
Screen Keyboard
Input Field
‘A’
instead
of
‘a’
chosen from keyboard Screen Keyboard
Input Field
No blank input
Screen Keyboard
Input Field
Exact
values
as
selected from keyboard Expected results: It is expected that ‘Exact values as selected from keyboard’ is valid (because it is the screen keyboard which should represent actual keyboard and should provide almost all important keys, it should be able to differentiate and accept caps alphabets, numeric and blank spaces)
71
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 3
Test Plan No. 4 Program: Checkout
Version number: 5.1
Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify payment method Objective: Ensure that payment request goes to one of the payment methods supported by this system
Program
Field
Values
Checkout
Payment Method
Cash
Checkout
Payment Method
Not available
Checkout
Payment Method
Card, Pay pal, Cheque (according to selection of user)
Expected results: It is expected that ‘Card, Pay pal, Cheque (according to selection of user)’ is valid (because valid payment method is one of them, any other form of payment will not be accepted by this system)
72
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 4
Appendix B The interview questions with its results Q.1) What are the number of items you want this website to support? Number of items is not fixed, as we want to add and remove items according to market situation. Some time it happens that certain items got more popularity and demand then others so in that case we want to shuffle the most demanded item with the least demanded item. Q.2) What are the number of roles you want this website to support? There are only two types of roles that we want this system to support and these are 1. Administrator 2. Customer Q.3) What should be the functions of these roles? Administrator: 1.
Has to announce different type of categories and items to sell.
2. Set price for each item. 3. Is also responsible to enter quantity of each item. 4. Should monitor each customer. 5.
Produce report about each customer and his payment, which they spent. 73
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Customer: 1. Can view different items, their details, quantity and price. 2. Has to add item to cart. 3.
Has to pay money with three different ways to purchase the items.
4. Review report about each transaction. 5. Review report about all items purchased. Q.4) What would be payment ways for customers to pay money? There are three popular ways to pay money for items that user purchase. These are very well known ways of transaction of money and normally a user may be in use with one or all of them. These ways of paying bills are as follow: 1. Pay pal 2. Card. 3.
Cheque or bank draft. Q.5) What sort of the security threats that you are worried
about? Security is one of the key requirements of such sort of system. It is a business application and every now and then users have to purchase item and send money in any of the above three forms. It would be worse 1. If someone break through the system and collect valuable information regarding user. 2. If someone redirect purchase item to wrong location. 3. If someone hack the website and cause business losses. Q.6) Which areas would you like to protect more? Although it would be admired if everything would develop according to some standards. Information should be process safely. However, it would be best if following list might be protected. 1. Input of information should be in any secure form. 74
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2. Information should transmit safely over network or network of networks. 3. Information should be saved in database in disguised format.
Appendix C The interview questions with its results Q.1) Would it be better for you to have a screen keyboard from where a user does not has to enter any entry, user just has to select figures or letters with mouse or touch pad (this would be better for security purpose as many spy programs reads keyboard input and send them to dangerous person)? Nearly 90% of users agree with this idea because they want their information to be transmitted and processed in safe environment. Nearly 10% of user does not agree with this idea because they think that keyboard is much quicker then mouse or touch pad and it would waste time of those users who do not want to use keyboard. Q.2) Would you like your information to be encrypt in a way that no one can read or understand it. Only this program holds a key (which is also resided in encrypted form) to descript that information and show it to user? Nearly
95%
of
users
agree
with
this
duel
encryption
mechanism. They believe that by this way there information can be safer and no one can break in to system. While 5% still believe that there would not be any security threat and this mechanism would decrease speed of processing because of extra effort requires to read and decrypts key and then uses it to decrypt other information hold by system. Q.3) Would you like to have report of all items purchased by you?
75
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
96% says yes which 4% says no.
Q.4) Would you like to have a validation mechanism which will ensure that those items which are out of stock should not be placed on shelf to sale? 90% says yes to this question because it would save time and efforts of user by taking their attention away for finished products. 10% says no to this question because they want to know information regarding all items irrespective of their availability. Q.5)
Would
you
like to
have some
sort
of reporting
mechanism which can assist administrator to get report according to item or customer and can assist a customer to get report according to item of date of purchase? 85% says yes to this and believe it is a nice idea which can keep them informed about their business history. While 15% says no because they believe that there is no need of report because a customer or either an administrator just interested in what is the current situation of business
76
Mansuor H. Almalki
This dissertation is submitted in partial fulfilment of the requirements for the degree of Master in Internet, computer and system Security
DEPARTMENT OF COMPUTING UNIVERSITY OF BRADFORD
2007
Abstract
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
MSc Internet Computer and System Security 2006/08 Internet Security and Usage By Mansour H. Almalki Project Supervisor: Dr Mumtaz A. Kamala
The increasing of E-commerce with its significance to the global trade system, the security of E-commerce and mainly of their Web sites becoming more important. Many systems have been planned to ensure confidentiality, authentication and integrity of transactions. On the other hand, even if some of these resolutions have been deployed, security side of E-commerce is still easily broken. E-Commerce Web still vulnerable to many kinds of attacks, which are developing incessantly. For instance, ECommerce Web sites such as HSBC bank, Boots and EBay have been subject of fabulous stories of attacks such as DOS, Phishing or other kind of passive attacks that have caused significant harms and losing of a lot of money as well as the trust of customers. The aim of this dissertation is to propose the E-commerce approach to improve security against the new generation of E-commerce attacks. Because of the enormous of this subject, businesses to consumer Web site will developer to be an example and to be easier to show that how the security mechanisms have done.
Dedications To my wife, for your continued moral support and encouragement during the year that I wish it could have lasted forever and to my parents, for your continued support and for offering me this big opportunity to move on with my studies.
Acknowledgements This research report has been submitted with the continued help and instructions of my supervisor, Dr Mumtaz A. Kamala. I am able to produce this report due to her guidance throughout the process of the research. Special thanks to him for his helping during the period, which are, spend together.
Table of Contents Abstract....................................................................................................2 Dedications..............................................................................................2 Acknowledgements................................................................................2 LIST OF TABLES.......................................................................................7 2
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
LIST OF FIGURES....................................................................................8 Chapter 1 Introduction.............................................................................10 1.1 Project Overview...........................................................................................................................10 1.2 Scope of the Dissertation...............................................................................................................10 1.3 Technologies to be Used................................................................................................................10 1.4 Background....................................................................................................................................11
Chapter 2 Security Principals..................................................................12 2.1 Understanding the Levels of Security............................................................................................12 2.2 The Goals of Security in E-Commerce..........................................................................................14 2.3 Secure Web site Guidelines...........................................................................................................14 2.4 Security Threats.............................................................................................................................15 2.4.1 Malicious code.....................................................................................................................................16 2.4.2 Hacking...............................................................................................................................................16 2.4.3 Information Gathering.........................................................................................................................16 2.4.4 Denial of service attacks (DOS)...........................................................................................................16 2.4.5 Internal attacks.....................................................................................................................................16
Chapter 3 Security and Usage.................................................................17 3.1 Encrypting Sensitive Data in a Database.......................................................................................17 3.1.1Introduction..........................................................................................................................................17 3.1.2 How It Work........................................................................................................................................17
3.2 Avoid SQL Injection Attacks........................................................................................................18 3.2.1 SQL injection techniques.....................................................................................................................18 3.2.2 To help protect against a SQL Insertion attack:...................................................................................19
3.3 On–Screen Keyboard.....................................................................................................................21 3.4 Password Security..........................................................................................................................21 3.4.1 Introduction.........................................................................................................................................21 3.4.2 General password construction policies...............................................................................................21
3.5 SSL (Secure Socket Layer protocol).............................................................................................22 3.5.1 Introduction.........................................................................................................................................22 3.5.2 SSL Certificate....................................................................................................................................22 3.5.3 Installing SSL......................................................................................................................................23
3.6 EV SSL (Extended Validation Secure Socket Layer protocol).....................................................23
Chapter 4 Payment Systems...................................................................26 4.1 Introduction....................................................................................................................................26 4.2 Online Payment Methods.............................................................................................................26 4.2.1 Introduction.........................................................................................................................................26 4.2.2 Payment Gateway (Real Time):...........................................................................................................26 4.2.2.1 Merchant Account.............................................................................................................................26 4.2.3 Payment processors (Delayed Response).............................................................................................28
4.3 Offline Payment Systems...............................................................................................................29
Chapter 5 Literature Review....................................................................30 5.1 introductions..................................................................................................................................30 5.2 Boots..............................................................................................................................................30 5.3 Dixons............................................................................................................................................30 3
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
5.4 Flowers direct................................................................................................................................31
Chapter 6 Work Plan...............................................................................32 6.1 Time Table.....................................................................................................................................32
Chapter 7 Methodology...........................................................................33 7.1 Introduction....................................................................................................................................33 7.2 Water Fall Model...........................................................................................................................33
Chapter 8 System Analysis......................................................................35 8.1 Introduction....................................................................................................................................35 8.2 Requirements Gathering................................................................................................................35 8.3 Interview........................................................................................................................................35 8.4 Questionnaires...............................................................................................................................36 8.5 Task Analysis.................................................................................................................................36 8.5.1 Admin Registration..............................................................................................................................38 8.5.2 Admin Login........................................................................................................................................38 8.5.3 Category..............................................................................................................................................38 8.5.4 Item......................................................................................................................................................38 8.5.5 Report..................................................................................................................................................38 8.5.6 Cart......................................................................................................................................................38 8.5.7 Checkout..............................................................................................................................................39
Chapter 9 System Design........................................................................40 9.1 Introduction....................................................................................................................................40 9.2 Use Case Diagrams........................................................................................................................40 9.2.1 System Boundary.................................................................................................................................41 9.2.2 Registration..........................................................................................................................................41 9.2.3 Login...................................................................................................................................................42 9.2.4 Category..............................................................................................................................................43 9.2.5 Item......................................................................................................................................................44 9.2.6 Cart......................................................................................................................................................45 9.2.7 Checkout..............................................................................................................................................46 9.2.8 Administration Report.........................................................................................................................48 9.2.9 Customer Report..................................................................................................................................49 9.2.10 Logout...............................................................................................................................................50
9.3 Class Diagram................................................................................................................................51
Chapter 10 Implementation.....................................................................52 10.1 Introduction..................................................................................................................................52 10.2 System Mode...............................................................................................................................52 10.2.1 Console Based Application................................................................................................................52 10.2.2 Web Based Application.....................................................................................................................53 10.2.3 Chosen Mode of Application.............................................................................................................54
10.3 Programming Language...............................................................................................................54 10.3.3 ASP.NET...........................................................................................................................................54
10.4 Database Management System....................................................................................................56 10.4.1 Introduction.......................................................................................................................................56 10.4.2 Coding...............................................................................................................................................56
4
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
10.4.3 Project Interface with Description......................................................................................................62
Chapter 11 Testing..................................................................................70 11.1 Introduction..................................................................................................................................70 11.2 Test Plan......................................................................................................................................70
Chapter 12 Conclusion............................................................................71 12.1 Introduction..................................................................................................................................71 12.2 Critical Assessment......................................................................................................................71 12.2 What have been done...................................................................................................................72
References...............................................................................................73 APPENDICES..........................................................................................75 Appendix A Test plan..........................................................................................................................75 Appendix B The interview questions with its results..........................................................................79 Appendix C The interview questions with its results..........................................................................81 Appendix C The interview questions with its results
LIST OF TABLES Table 3.1 Characters Using in SQL Code Injection.....................................................25 Table 6.1 Time Table...................................................................................................37 Table Appendix A Test Plan No. 1...........................................................................78 Table Appendix A Test Plan No. 2...........................................................................79 Table Appendix A Test Plan No. 3...........................................................................80 Table Appendix A Test Plan No. 4...........................................................................81
5
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
LIST OF FIGURES Figure 2.1 Levels of Security.......................................................................................14 Figure 2.2 Points the Attacker can Target....................................................................18 Figure 3.2 IE7 Address Bar with EV SSL...................................................................29 Figure 3.3 IE7 Address Bar Securities with EV SSL...................................................30 Figure 4.1 Payment Gateway ......................................................................................31 Figure 4.2 PayPal Gateway..........................................................................................33 Figurer 7.1 Water Fall Model.......................................................................................36 Figure 8.1 Task Analysis..............................................................................................48 Figure 9.1 Use Case Diagrams.....................................................................................51 Figure 9.2 System Boundary Diagram.........................................................................52 Figure 9.3 Registration Diagram..................................................................................52 Figure 9.4 Login Diagram............................................................................................53 Figure 9.5 Category Diagram.......................................................................................54
6
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 9.6 Item Diagram..............................................................................................55 Figure 9.7 Cart Diagram...............................................................................................56 Figure 9.8 Checkout Diagram......................................................................................57 Figure 9.9 Administration Report Diagram.................................................................59 Figure 9.10 Customer Report Diagram........................................................................60 Figure 9.11 Logout Diagram........................................................................................61 Figure 9.12 Class Diagram...........................................................................................62 Figure 10.1 Login Form...............................................................................................77 Figure 10.2 Onscreen Keyboard Form.........................................................................78 Figure 10.3 Adding New Category Form.....................................................................79 Figure 10.4 View and Update Categories Form...........................................................80 Figure 10.5 Add New Item Form.................................................................................81 Figure 10.6 Add Item to Cart Form..............................................................................82 Figure 10.7 Checkout Form.........................................................................................83 Figure 10.8 Report Form..............................................................................................84 7
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 1 Introduction 1.1 Project Overview “E-Commerce embraces all aspects of buying and selling products and services over a network.” (Norris & West 2001) Since the author studied at the university, he was focusing on Internet and System Security where E-commerce is found the most attractive field to implement this sort of knowledge. However, the growth of shopping over the Internet is encouraging more businesses to consider the profits of developing E-Commerce Web sites. Although online shopping has great and clear advantages, there are also many security issues that should be understood when E-Commerce website is developed. The overall aim of this master dissertation is how to build a Business to Consumer website that is a kind of E-commerce and how to investigate the major security threats in the E-commerce world and their lasts solutions that an online Web site may face. In particular, the project aims to the importance of cryptography, validation, create secure session, SSL, avoid SQL injection, password polices and electronic payment method by designing keys that can help to view the security on online Web site. This research provides the basis for a comprehensive Internet security, which can be developed further.
1.2 Scope of the Dissertation •
Development of online shopping Web site. 8
Mansour H. Almalki •
• •
MSc. Internet computer and System Security, 2007
Application of security in E-commerce techniques to acquire practical knowledge of security systems. Improvement of usability and acceptability of product. Informing the new technology and development in security system.
1.3 Technologies to be Used The online shopping Web site Tools is implemented using the high level language which is ASP.NET 2.0 with Visual Basic.NET script as front end programming language and JAVASCRIPT as client end validation language. SQL SERVER 2005 (express edition) used for storing the data in the database and SQL SERVER MANAGEMENT STUDIO for managing the database. Moreover, used MICROSOFT WORD 2007 and MICROSOFT VISIO 2003 for drawing the diagrams and organizing the document.
1.4 Background Turban et al (2003) their recent research paper found that E-commerce could bring the following benefits to both organization and consumer: • Offer significant cost saving since E-commerce a lower technology cost. • Market of products will be on an international level. • The organization work’s speed and flexibility will be improved dramatically. • Decision making will be developed to follow the new technology. • The customer base will be increased. • Lower procurement cost for both organization and consumer. • Business intelligence will be improved. Turban et al (2003) have shown that E-Commerce almost is not a new type of commerce. It first appeared on local networks, as normally large company developed electronic data interchange installations and banks implemented electronic funds transfer. Otherwise, the Internet and mainly the World Wide Web not only show the large companies, it also provides a viable entrance point for small and middle-sized projects into E-Commerce world. E-commerce can be one of these topics: B2B (business-to-business), B2G (business-to-government), B2C (business-toconsumer), C2C (consumer-to-consumer), G2B (government-to-business). Most public are familiar with Consumer-to-Consumer electronic business (C2C) like Auction web site and the good example is EBay. Furthermore, there is Business-to-Consumer electronic business (B2C) like Amazon, Boots, T-mobile, etc. The Business to Consumer is involved to present online products, services and information to a large filed of internet customers. The Web sites which offer consumer banking facilities, online shopping, and other services. They will continue by having a proficient management team, 9
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
perfect post sales system, a good network infrastructure, attractive designed website and a security mechanism against hacker or eavesdropper. In addition, online shopping Web site publishes news and information about its products and services. This information may contain a description of the products and services along with appropriate static, video and images. This view has been supported in the work of Rajput (2000).
Chapter 2 Security Principals 2.1 Understanding the Levels of Security The important factor to create a secure environment is to start with security which include the main principles of security (confidentiality, integrity and availability).This means applying the principles of security as the base, which the rest of the project will be made that mean to achieve a high level of security the project must address these principles in all phases and applications from beginning to end. Overall, for typical web applications, the primary tasks for implementing security are always the same. According to Russsell et al (2001), the levels of security contain:
Figure 2.1: Levels of Security. Confidentiality: it means that information is available only to users authorized to access it. It is for the most part widely known of the principles. Businesses have been dealing with confidentiality while commerce started. Now, it is a critical expectation of customer that their personal information will be in secure. Merchant also expect a level of confidentiality to protect price, custom scheduling and customer details. The idea of confidentiality is widely accepted. Conversely, remains difficult to execute.
10
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Information is probably one of the most costly resources most companies have; losing it or carelessness for it could do disaster and possibly even spoil. For that reason, while the user is handling with the online Website, it has to be ensuring that nobody else is able to sight sensitive data, which is processed by the user. Consequently, the line between the consumer’s browser and the web server has to be encrypted. In addition, the data stored on the cookies on the client have to be encrypted; even database administrators or other employees of the company where the web application is hosted may not view the data. There are some important question it should be though about it, if the company had cracked the files of these customers, what would the damage to the company have been? How would the company deal with such a situation? Integrity: Information is accessed only by right users. This can also be referred to as defining levels of security. It is perhaps the most complex of the principles to achieve, up until now it is the most fundamental of the three. Businesses have to build, manage and maintain the integrity of the information with which they are entrusted. The least corruption of that data can make whole chaos. Constantly, different ways have developed for manage and maintaining the integrity of information. There are many entries accounting system, the creation of works such as editors and proofreaders, and the modern checksum methods are all technical advances intended at producing integrity. However, even all of that, integrity still one of the greatest worthwhile. Integrity is something we approximately take for granted. We suppose that the database system, which we are using, will maintain the records of our sales perfectly. We consider that our billing system is smart by default to add the goods on a customer’s invoice. The lacking of some type of integrity checking, neither of these conditions may be true. Integrity of information can have an even larger impact on the company. Therefore, the data transmitted between the client and the server has to be not changed by illegal users. Digital signatures provide this type of threat.
11
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
We should think of that when a new malicious virus that infected the accounting systems of and muddied all the data in the database, turning them into threes. What would the effect of those illegal modifications mean to the company’s business? What reactions would the company obtain to recover the correct data and how would the company even find out the damage? Availability: the system can be only available for authorized users. It is last, but not least, of the three principles. Availability is the lifeblood of any business. If a consumer cannot get to his account to purchase the goods, the business will soon be unsuccessful. In the E-commerce, where every second can in a straight line translate to thousands or millions of pounds in sales, even downtimes of less than an moment can perform huge financial scratch to a company. Think of the quantity of damage done to the company if the company’s Web site became unavailable for some of minutes, which is the period that most sellers used as a benchmark for turnaround time in the Internet. A comedown in business could cost millions of pounds, if it happened. We should consider of those problems: How long could the company continue doing business if the network was damaged? How much money per hour would the company afford if they could not be online?
12
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2.2 The Goals of Security in E-Commerce Security plays a very important function in E-commerce and these goals of security in the commerce process must be to: •
The privacy of the consumer at the point of purchase should be protected.
•
The privacy of the customers’ information while it is stored or processed should be protected.
•
The confidential identity of customers, vendors, and employees should be protected.
•
The company should be protected from waste, fraud and abuse.
•
The information assets of the company should be protected from discovery and disclosure.
•
The integrity of the organization’s information assets should be protected.
•
Guarantee the availability of systems and processes required for consumers to deal with the corporation.
•
Guarantee the availability of systems and processes required for the corporation deal with its vendors and partners. (Russsell et al 2001)
2.3 Secure Web site Guidelines In fact, a secure architecture and design alone does not make a completely secure application. It is only one of the most significant issues, which should be dealing with it to make secure environment. Moroney (2006) demonstrated that is including: •
• •
• •
User input is malicious data: that mean all users are evils until they proven the opposite. Consequently, validate user input should be strongly. The validation code is secure that it verifies input against only allowed values and not invalid values like (--) which is used in SQL injection. Using a string concatenation for creating SQL statements will be disaster: using parameterized statements is safest method as a result the application is not SQL injectable. Output data entered by a user directly on the Web page must be validating and encoding first: The user might enter some scripts, which guide to cross-site scripting vulnerabilities. For that reason, constantly Http Utility should be used. Sensitive data should not be stored in the Web site application even in hidden fields: Hidden fields can be modified simply by just pressing write click and choosing view the source of the web page. Sensitive data should not be stored in view state: View state is just a different hidden field on the Web site, and it can be translated and 13
Mansour H. Almalki
• •
MSc. Internet computer and System Security, 2007
viewed simply. That is happened by using the EnableViewStateMAC=True setting for the Web site. Cookies should be Protected: Always protect the authentication cookies when using forms authentication, and set timeouts as short as possible and only as long as necessary. SSL must be used in E-commerce Web site because, they processes sensitive data and SSL make it more protected. Even image directories or directories with other files not managed by the application directly through SSL should be protected.
2.4 Security Threats Khusial & McKegney (2005) have showed that there are four major players in E-commerce security. The first player is the shopper who uses his computer to login the shopping Web site and purchases items. The second player is the Web site, which is control by a merchant who is selling goods or services on the Web site. The third is the software, which is run the Web site; it is usually developed from third party. The fourth player is the attacker is the player whose try to get information illegality. Figure 2.2 illustrates the players in a shopping experience and the point which attacker can target.
Figure 2.2 Points the attacker can target taken from Khusial & McKegney (2005) The security threads could be one of these points: 2.4.1 Malicious code
It includes viruses, Trojan horses, worms and harmful scripts. These techniques are used by hackers to crack the Web site of companies and be able to disturb or get back sensitive data. 2.4.2 Hacking
Hackers use their skills and discover weaknesses in shopping web sites or the systems to get information and break the trust of companies trading in the B to C environment.
14
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2.4.3 Information Gathering
Information gathering is also a way of compromise merchant Web site transactional or confidential information. This could be done by one of these methods: • Social engineering: The easiest way of attacks. The hacker can compromise and find fault in merchant Web site by just having phone conversations with company by asking simple questions like what database or operating system is used in the company. That will allow the hacker to attack the system or the Web site. •
Rubbish: when the staff or users throw away a paper, CDs, DVDs or hard disk that includes sensitive data.
•
Network sniffing: the hacker monitors the data and network by using special programs. He can get some sensitive data as the consumer details or credit card numbers.
•
Guessing passwords: Another regular attack is to guess a user's password. For instance, some uses use their name as the password. This style of attack could be manual or automated by using particular programs.
•
Phishing: the hacker is tried to obtain sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy merchant Web site. eBay, PayPal and online banks are common targets. It is normally happens by email or instant messaging.
2.4.4 Denial of service attacks (DOS)
When the attacker floods the merchant Web site with useless traffic making the server over load. It is an attempt to make the Web site resource unavailable to its intended users. For E-commerce, this is a very unwanted and more importantly a costly situation. 2.4.5 Internal attacks
It could be come from company staff or the third party provider. We have to think of it as well as the external threats.
Chapter 3 Security and Usage 3.1 Encrypting Sensitive Data in a Database 3.1.1Introduction
Often the E-commerce Web site staffs do not understand the amount of hazard associated with sensitive information within. The database is the main goal for hackers, which they are trying to get into the database. Using technologies such as Secure Sockets Layer (SSL) is to secure transport confidential user information across network connections. However, what we should do about storing the customers' confidential data securely? Even we can not trust in own staff to have access to such confidential information. 15
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
The E-commerce Web site that has customers table is the most important table in the database. This table might have columns like Name, Address, Email, and password. Obviously all of the records and fields in the Customers table are meant to be kept private. That is, while our customers would certainly be wearied if their email address and password was discovered by hackers. Consequently, the worst we might be planed so it should be very hard for hacker to break it. The encrypting and decryption functionality of database is one of the beast solutions to insure that kind of security. (Mitchell 2005) 3.1.2 How It Work
Mitchell (2005) has proved that there are seven steps in order to do the encrypted and decrypted sensitive data to make it in secure way and away from disclosure. These seven steps are: • • • • • •
•
Take the user information in a plain-text input. Encrypt that information. Convert them from a string into a byte array. If we want to read the encrypted data from the database. Convert it from a byte array into a string. Decrypt them. Work with the plain-text data.
More issue in cryptography will discuss in implementation section of this project.
3.2 Avoid SQL Injection Attacks The basic meaning of SQL Injection is that a hacker can put extra SQL statements into the commands, which process at the database. These commands can recover sensitive information from the database. Code that is vulnerable to SQL Injection command strings with external input. 3.2.1 SQL injection techniques
Sharma (2005) illustrated that there are two of the SQL injection techniques are commonly used: 3.2.1.1 Access through Login Page
•
Using ‘or’ condition
To bypass this authorization, the hacker will have to enter the following SQL symbols: Username: Password:
Ram ‘or 1=1 -16
Mansour H. Almalki
Output will be: •
MSc. Internet computer and System Security, 2007
"Logged In SQL world ".
Using ‘having’ clause
Username:
' having 1=1 --
Password:
[Anything]
Output will be: browser contain the
" Error".
And will show error message in the
name of database and attribute name. •
Using multiple queries
Username:
' or 1=1; drop table users; --
Password:
[Anything]
Output will be: Then the query would execute. • Using extended stored procedures
Username:
';exec master..xp_cmdshell ‘iisreset’;--
Password:
[Anything]
Output will be: (stored
This would send a query to SQL Server to execute procedures user or database should have
necessary privileges). 3.2.1.2 Access through URL •
By manipulating the query string in URL
When URL looks like:
www.sqlproduct.com/sqlproducts.asp?p_id=7
The hacker can write: p_id=0%20having%201=1 Output will be: and he could exploit
http://sqlproduct/sqlproducts.asp?
he can get details of SQL server version the vulnerabilities linked with this version
,if the SQL server is not fully patched . •
Using the ‘SELECT & UNION’ statements
For example, this is will happened if returns employee information when a city is entered. The attacker is able to use sysobjects and syscolumns tables to make UNION statement. The table sysobjects for the table names and syscolumns for the fields. The following injection string can be used: ’ UNION ALL SELECT pname,p_id, ‘5’ FROM sysobjects WHERE ptype = ‘U.
3.2.2 To help protect against a SQL Insertion attack: •
All queries should be stored as procedures. The way SQL parameters are passed prevents the use of apostrophes and hyphens in a way that would let an injection attack to happen. In 17
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
addition, it lets database authorizations to be limited to only permition specific procedures to be applied. All user input must then fit into the context of the procedure being called and it is less possible an injection dangerous could happen. •
The length of the form or query string input is limed to 10 characters long and more characters is not allow than that to be input for the value. This will make it more hard to SQL inject damaging SQL statements into the input.
•
Sensitive data like user name, password, address and Email have to be encrypted. Encrypt user input for comparison against the data, which is stored in the database. The data is at this time being compared in a sanitized fashion that has no meaning to the database and avoids the hacker from injecting SQL commands.
•
Using on screen keyboard to input the data and avoid entering by pressing on the keyboard that will make the restriction of characters is more essayer. Avoid dynamic SQL. Execute with Least Privilege: for example, a stored procedure always-return only one row of data will be better than granting the user/role read access overall table.
•
•
Do not display errors to the user that contain all kinds of wonderful hacking information like table names, fields, database drivers, sql statements, etc. Use a custom generic web page in ASP.NET.
•
Validating the input characters, there are at least four steps should be done for input validation: 1. Filter out character like single quote, double quote, slash, back slash, semi colon, extended character like NULL, carry return, new line, etc, in all strings from: Input from users, Parameters, URL and Values from cookie. 2. Make sure numeric fields really look like numbers. 3. Do step 1" and 2" not only on users' direct input, but on all nonconstant variables. 4. Check if the inputs are within your expectation (e.g. 0 < age < 120, login id without space, etc.). (Sharma 2005)
No
Characters
1
SPACE
2
\SPACE
3
\'
4
' 18
Mansour H. Almalki
MSc. Internet computer and System Security, 2007 5
\"
6
"
7
--
8
\-\-
9
\=
10
=
11
\;
12
;
13
\#
14
#
Table 3.1 Characters Using in SQL Code Injection
3.3 On–Screen Keyboard On–Screen Keyboard is a value technology used in the past by Microsoft company to shows a virtual keyboard on the screen that permits users with mobility impairments to type data by using a pointing device or joystick. Besides providing a minimum level of functionality for some people with mobility impairments. Now, there are many companies, banks and E-commerce web site used the on-screen keyboard for security propose. As we know, that spyware and other malicious software can log all key strokes, record keystrokes and steal the user details then sent out to the hackers. Therefore, the sensitive date should be entered via the on-screen keyboard to prevent key strokes logged by spyware when using internet shopping on the Internet.
3.4 Password Security 3.4.1 Introduction
Passwords are mostly like a key that are the way to access an accounts, personal information, software applications, etc. Passwords help to certify that only authorized user to access to the Web site, user accounts and email accounts. Moreover, Strong passwords are an important aspect of Internet and system security. Any user should create strong secure passwords and keep them in a safe and secure way. Therefore, Easy-to-guess passwords could compromise the security and put the secure information at risk. The main problem is that many users use one password for using it in everywhere other problem is using Easy-to-guess passwords so in the next making strong password will be discussing.
19
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
3.4.2 General password construction policies
There are the particular policies that password must be conformed in order to be accepted as a strong password: •
Passwords should not be based on well known as the personal names, address or countries. It is very easy for hackers to guess things like that information.
•
Password length defiantly will increase the security. Passwords should be eight or more characters in length.
•
Random combination of upper-case and lower-case letters and digits should be in the password.
•
Passwords must not contain dictionary and/or foreign words (word found in a English or foreign dictionary).
•
Password should be changed at least every 30 - 60 days and the old passwords should not be re-used for a period of 6 months.
•
Using the same password for different accounts absolutely is a wrong idea.
•
Password should not be reveal over the phone or in an email message. (SANS Institute 2006)
3.5 SSL (Secure Socket Layer protocol) 3.5.1 Introduction
The Secure Socket Layer protocol was created by Netscape in 1994. It is commonly used for topics: to validate the identity of a Web site and to create an encrypted connection for sending credit card and other personal data. Martin (2002) explained that in short how it works: 1.
A browser requests a secure page. It usually start like this https://.
2.
The web sends its public key with its certificate server after receive the requests from the browser.
3.
The browser checks that the certificate it is valid, related to the same site and it was issued by a Certification Authority (like VeriSign).
4.
The browser then uses the public key of the web server to encrypt a random symmetric encryption key and sends it to the web server with the encrypted URL required with other encrypted http data and send it to the web server.
5.
The web server receive the symmetric encryption key and decrypts, by using its private key and uses the symmetric key to decrypt the URL and http data. 20
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
6.
The web server sends back the requested html document and http data encrypted with the symmetric key to the browser.
7.
The browser decrypts the http data and html document using the symmetric key .Now the browser can shows the Web site in secure way.
3.5.2 SSL Certificate
Usually, an SSL Certificate will contain the domain name, company name, address, city, state and country. It will also contain the expiration date of the Certificate and information of the Certification Authority responsible for the issuance of the Certificate. When a browser joins to a web server it will check that it has not expired, contain the write information, it has been issued by a Wright Certification Authority and it is being used by the website for which it has been issued. If any of them is fails, the browser will show a warning to the consumer and allow him to know that the Web site is not secured by SSL. According to VeriSign SSL Certificates enable 128- or 256-bit, which hard to decrypt and it is suitable to over 99.9% of Web site visitors. E-commerce Web sites, which use it, have a strong encryption and give consumer a greater privacy with reduced hazard of fraud and identity theft. There are two general indications of a secured web site: The first one is by checking the web page URL. Usually, the URLs begin with the letters "http". On the other hand, over when using SSL the address comes like this "https". The second way is by checking for the "Lock" icon. There is a "lock" icon wherever in the window of the browser (NOT in the web page display area) for instance, Microsoft Internet Explorer displays the lock icon in the lower right of the browser window as in the figure. When double click on it will show information of the site's security. It is necessary to double chick the icon to know what is contain.
3.5.3 Installing SSL
The steps involved in installing a SSL certificate, therefore enabling SSL to provide security the Web site: •
Purchase SSL Certificate: The first step is to purchase a SSL certificate. There are many companies offering the SSL or EV SSL technology that it might be differ from each other based on brand and features.
•
Generate a CSR(Certificate Signing Request): From the web server that will be SSL enabled, a CSR should generate, saved the CSR to a text file and sent to the provider. For detailed CSR generation instructions based on which brand of web server you are using. On the other hand, 21
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
the provider will generate it if they will be the hosting for the web site. •
Enrol for a SSL server certificate: The merchant should log in to the provider Web site, confirm the domain name is correct and he should enter other information like the address and the contact information.
•
Install the SSL server certificate: Simply that will be paste the CSR text that the provider sent (either through email or downloaded from your SSL.com account) inside the Web site and monitor the certificate status.
3.6 EV SSL (Extended Validation Secure Socket Layer protocol) According to Microsoft Web site Extended Validation SSL Certificates offer high security Web browsers information to obviously identify a Web site’s organizational identity. Extended Validation SSL certificates protect consumers from dealing business with untruthful web merchants. Basically, EV SSL certificates are the new type of certificate that provide exact authentication for a business' identity. Internet Browser recognizes EV certificates for businesses that have completed this process, and visually represents them by colouring the Address Bar in green colour.
Figure 3.2 IE7 Address Bar with EV SSL taken from http://www.microsoft.com/windows/products/winfamily/ie/ev/default.mspx
In addition to changing the Address Bar shading, EV certificates display details about the business, such as location for incorporation and 22
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
country. If customer of Web site, seeing the green Address Bar and the owner and country information that would help him verify the identity of the Web site to decide it is the certainty Web site or not. Moreover, the customer will be certain that information remains secured from strangers. On the other hand, we have to recognize that an older browsers will display Extended Validation SSL Certificates with the same security symbols as existing SSL Certificates.
Figure 3.3 IE7 Address Bar Securities with EV SSL taken from http://www.microsoft.com/windows/products/winfamily/ie/ev/default. mspx
23
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 4 Payment Systems 4.1 Introduction There are two ways for payment in Ecommerce Web site online payment and offline payment.
4.2 Online Payment Methods 4.2.1 Introduction
Online payment method is the easiest and fastest way to receive the cost of orders with sending an automated email including the invoice. The ordering physical products will be shipped only after the payment has been confirmed. There are two categories of on-line payment: 4.2.2 Payment Gateway (Real Time):
Cooper (2002) has confirmed a payment gateway is an online method for processing credit card or other payment transactions in realtime. A payment gateway is normally linked to a merchant account. The payment gateway facilitates the management of communicating a payment transaction between the different payment networks or banks. A payment gateway typically provides extra features for example: online virtual terminal for manually processing transactions, transaction reports and more. 4.2.2.1 Merchant Account
A Merchant Account involves a particular sort of agreement with a bank or clearing house that lets the merchant to accept credit card payments into his Account. The results of any credit card transactions passed through the merchant online authorization company are then, expectantly, credited to the merchant account if the transaction is permitted. A Merchant Account is the most cost effective way of accepting payment by credit card. In addition, using a merchant account with the company who will authorize the payments online led to the ability to accept credit card numbers on the Web site, and then receives any payments due to the price of orders. It is as simple as that.
Online Web site
Payment Gateway
Company
24
Merchant Account
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 4.1 Payment Gateway taken from https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-gatewayoverview-outside&nav=2.0.3 1. The customer enters credit card details on the Online Web site. 2. The Payment Gateway encrypts that information and securely sends it to Merchant Account Company. 3. The transaction is checked for authorization reason. 4. The result is encrypted and sent back via the payment gateway. 5. The customer gets the results and makes a decision if he wants to apply the order or not.
(Pay flow Payment Gateway available on PayPal Web site) There are several steps to get funds from the customer’s credit card and add it to the merchant account, the first is approving the deal and taking the customer's credit card information on the Web site. After that, the card has to be verified and approved, to ensure that it has not been stolen, or has expired. The Merchant Account Company might give this service, or the merchant might decide to use an online authorization company. After the card has passed exact security verify, the merchant account provider or online authorization company then send the information to their credit card processor who debit the customer's credit card and deposit the funds into the merchant account. This sequence of actions obtains between 1 and 3 days for the majority of merchant account providers. Then within frequently three days, the customer's card will be debited and the Merchant Account credited. The Merchant Account Provider will also take a commission of approximately 4% per transaction. In the end, the merchant have to send an invoice via an e-mail immediately to the customer (that will happen automatically). The advantages of using Payment Gateway •
Payment gateway providers do not intrude on the merchant branding.
•
They are invisible to the consumer (the Web side is appeared more professional).
25
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
•
Payment gateway providers offer immediate feedback to the merchant.
•
Payment gateway providers supply an additional professional resolution.
•
The majority of payment gateway providers have strong fraud protection.
•
Money after checking automatically deposited in the merchant bank account.
•
They improve the bookkeeping features.
•
The large company deal in this way. The disadvantages of using Payment Gateway
•
Payment gateway providers are more expensive and involved to sign up / set up.
•
Require a merchant account.
•
Usually require a good credit history.
4.2.3 Payment processors (Delayed Response)
The alternative way to have merchant account is payment processors when there are many companies provide this serves one of the most famous is PayPal. 4.2.3.1 PayPal
PayPal take place from the popularity of eBay Web site auctions, then it is quickly becoming an incredibly accepted payment option in payment processors world. The PayPal solution allows customers to shop on the Merchant Web site then make payment at the PayPal website with a credit card, when the transaction is completed, they are returned to the merchant Web site. Merchant Web site
PayPal web site
Merchant
Web site
Figure 4.2 PayPal Gateway taken from https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-prooverview-outside 26
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
PayPal Web site show that the most important issue for make papal well known is low cost of entry into E-commerce. It costs nothing for the merchant to setup a PayPal account and they have very reasonable processing fees of 1.1% to 2.4% + £0.30 for each transaction. Putting the PayPal name on the merchant’s websites can lend credibility to those online activities, which is significant when attracting consumers that might be hesitant to purchase from the internet. Now, PayPal lifted its condition for consumers to have a PayPal account, thus removing another barrier to new consumers that might not have understood or wanted to open a PayPal account just to make a purchase. PayPal is required only a bank account to deposit funds which is received from consumer. It does not require an online merchant account to receive payment by credit card. More over PayPal permits consumer to use bank accounts for payments further the main credit cards. On the other hand, PayPal offers limited fraud protection for both merchant and consumer. However, that It is not prevented PayPal to become a most important choice for businesses. The advantages of using payment processors. •
Less expensive and involved to sign up / set up.
•
Do not require a merchant account.
•
Usually do not require a good credit history. The disadvantages of using payment processors.
•
Payment processors providers intrude on the merchant branding.
•
Payment processors providers are visible to the customer.
•
They are offered delayed feedback.
•
Provide a less professional solution.
•
They do not always make automatic deposits, which is very strong problems.
•
Offer more disjoined record bookkeeping.
•
The small company deal in this way.
4.3 Offline Payment Systems Offline payment is one of the available payment methods to customers should the merchant choose to support it. Offline payment refers to payments that need manual processing. For instance, it can apply to the customer who is uncomfortable submitting a credit card number on the internet and chooses Cash On Delivery option, as well as the customer who submits credit card details where there is no supporting set up with a bank for automatic agreement. On the other hand, offline payment processing can take a long time comparatively (2-5 days) it can also increase the cost of doing business for the merchant. 27
Mansour H. Almalki
MSc. Internet computer and System Security, 2007 (WebSphere Commerce Information Centre 2005)
Chapter 5 Literature Review 5.1 introductions This is important chapters of the documentation. Literature review demonstrates the effort has devoted in dissertation about selected an idea and creates of understanding different existing systems. Shopping Web site based multimedia emailing system is not very new concept and many of them are in market. Some of them are freeware though others can bought by professional company. It would be hard to see all shopping Web site in the Internet but the famous of them will be studied and presented according to (www.vouchercodes.com) Web site.
5.2 Boots Boots is one of the best-known retail names in the UK providing health, beauty, baby, fitness and other products (www.boots.com). They provide Boots discount vouchers, online discounts and free delivery on Boots website all this things increase the consumer to visit the web site either they go to visit them shop. Unfortunately they use the old SSL version, it soups suppose to be EV SSL also they do not accept payment by payment processors for those people who do not want to use their credit card every time in the Internet. Finally, there are no password policies that mean the user can put a weak password and the system will accept it. Even they accept six characters for password, which suppose to be eight.
5.3 Dixons Dixons is now completely online (www.dixonos.co.uk). Dixons UK is now an online shop only and offers great value across the total range. Dixons electrical has been in the market now for over 73 years and prides itself on great brands at great prices. They use the last security technology even EV SSL. The disadvantage is that the password has six characters long without any password policies. Moreover, the Company do not accept payment by Payment processors.
28
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
5.4 Flowers direct Flowers direct (flowersdirect.co.uk). Flowers direct flower delivery service to anywhere in the UK at your fingertips. Flowers direct offer delivery flowers at great value, but most importantly all flowers are excellent quality with fast and reliable next day flower delivery service. The Company accept payment by Payment processors and that is good. On the other hand, it do not use be EV SSL. The disaster policy is the user can used only one character as a password.
In the next chapters, the Business to Consumer issues is discussed in detail. That will include building a shopping Web site to illuminate aim from the dissertation with the last technology which used in the market.
Chapter 6 Work Plan 6.1 Time Table Before initiation of the implementation for the project, tasks and scheduling to each task should be determined. This process is known as project work plan. In this part, it has to decide about task and allocate time according to its complexity and length. Task Name
Start Date 29
Finish Date
Mansour H. Almalki
1
MSc. Internet computer and System Security, 2007
Planning Phase Project Initiation
03/09/07
06/09/07
Back ground study
07/09/07
13/09/07
Feasibility Study
14/09/07
19/09/07
Project Work Plan
20/09/07
24/09/07
Requirement Analysis
26/09/07
28/09/07
Requirements
01/10/07
03/10/07
Requirement
04/10/07
08/10/07
Use cases
09/10/07
11/10/07
Sequence diagrams
12/10/07
16/10/07
Class diagram
17/10/07
19/10/07
22/10/07
24/10/07
Encryption and decryption
25/10/07
29/10/07
Literature review
30/10/07
02/11/07
Database design
05/11/07
09/11/07
Interface design
12/11/07
15/11/07
Program specifications
16/11/07
22/11/07
Functional Identification Non-functional Identification 2
Analysis Phase
Security keyboard)
3
4
aspects
(screen
Design Phase
Implementation Phase Security aspects development
23/11/07
30/11/07
Program development
03/12/07
18/12/07
Program testing and evaluation
20/12/07
25/12/07
Documentation
26/12/07
04/01/08
Project Submission
07/01/08
11/01/08
Table 6.1 Time Table
30
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 7 Methodology 7.1 Introduction It is not core requirement of this documentation and project to discuss about methodology chosen for development of this project. However, no project can ever achieve success if it does not carried out according to some predefine pattern and rules. These patterns and rules are known as methodology. Because of nature of each project is different for other, some projects are of same nature that is why they can be built according to same type of methodology while others might be done by completely different way of methodology.
Ways to carryout a task is known as methodology. These are some predefined rules which have to be follow in order to carryout successful completion of any project. Many methodologies have been developed, discussed and implemented in different projects. Each got there pros and corns. In addition, each project is of different nature and that is why some completely settle themselves in certain methodologies while they would become failed projects if they have been assigned unmatched methodologies. There are many ways to do methodology as prototyping, code and fix model, spiral model and water fall model which has been chose in this application.
7.2 Water Fall Model Parekh (2005) has illustrated that water fall model is one of the pioneer in field of methodologies. It has been evolved over time and it become base for development of other methodologies. Important aspects of this life cycle model are given below: 1. It is top-to-down life cycle model in which back tracking of moving back to any previous stage is prohibited. 2. Requirement of project should be known before start of project. 31
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
3. Requirements should not be change over time because changes are permissible. 4. All stages are completed as one by one in sequential way. 5. Project completes on time as new requirements are not allowed and designer can consistently decide about time to spend upon each stage. 6. It is consider as rigid methodology as it does not gives any flexibility, but still it has given many successful projects.
Figurer 7.1 Water Fall Model taken from Parekh (2005)
32
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Chapter 8 System Analysis 8.1 Introduction Requirements gathering of a project are one of the most difficult and important tasks which have to done because it would be desirable to gather all requirements before the start of project. Requirement that appear on later stage would cause delay and complexity in project. If information has achieved about core requirements then it would be easier to initiate and carryon project development.
8.2 Requirements Gathering According to Mochal (2001) requirements gathering are the process of understanding the consumer needs and expectations from a planned system or application. There are many methods for gathering requirements of any project. All of these have advantages and disadvantages. Therefore, it is a good idea if two or more of them have been done: •
Interview.
•
Questionnaires.
•
Task analysis.
It would be time driven process to carry out all techniques of requirement gathering. It would also take more time to present their output in documentation. Thus by considering time, availability and easiness following two has been chosen for gathering requirements.
8.3 Interview It is one of the most prominent and simple to use way of gathering requirements. Some experts believe it to be the best because it encourages a direct communication with user of system and designer. This sort of method gives designer a good chance to better understand actual requirements of user of system. Direct communication also encourages users to give their point of view. 33
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
There are some negative aspects of interview method. One of them is cost, it would be quite costly if more users have to be interview and also more time has to spend for each interview and such method become even more difficult if more users have to be interviewed. In addition, the whole Interview, which have made with its results is available on appendix B.
8.4 Questionnaires It is also one the most popular form of getting information. It is subjected to larger number of users and made it possible to get important information from them. It is not as effective as interview but still it provide sufficient information, which would become vital in the development of any project. A formal questionnaires session have been conducted. Main purpose of them was to gather user’s general point of view about purpose system. In addition, the whole questionnaires, which have made with its results is available on appendix C.
8.5 Task Analysis Task
analysis
is
an
efficient
technique
of
gathering
requirements for new system and to know exact functionality of old system. Task analysis is based upon a diagram which shows a hierarchy of tasks and corresponding sub-tasks. These tasks and sub-tasks represent functionalities of system have to be done in order to achieve systems objective. Below is a task analysis diagram of current system.
34
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Mansoor Shopping Center 0
Admin Registration 1.1
Add Admin Information 1.1.1
Administrator 1
Customer 2
Admin Login 1.2
Category 1.3
Update / Delete Admin Information 1.1.2
Customer Registration 2.1
Add Customer Information 2.1.1
Generate Login Session 1.2.1
Payment By Card 2.4.1
Item 1.4
Add Category 1.3.1
Customer Login 2.2
Update / Delete Customer Information 2.1.2
Logout 3
Update / Delete Category 1.3.2
Cart 2.3
Report 1.5
Add Item 1.4.1
Checkout 2.4
Generate Login Session 2.2.1
Add Items to Cart 2.3.1
Payment By Pay Pal 2.4.2
Update / Delete Item 1.4.2
Report 2.5
Update / Delete Items from Cart 2.3.2
Payment By Cheque 2.4.3
Figure 8.1 Task Analysis
Task which is at the top of this diagram known as “Mansour Shopping Centre” represents the whole system. All tasks below it are the main set of functionalities that suppose to be supported by this system. Descriptions of all prominent tasks are given below:
35
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
8.5.1 Admin Registration
Administrator of this system must register itself before its functionality. In registration, system would ask administrator personal information with login details that administrator likes to have. If this information is correct then system register administrator with it and now administrator can use system’s functionalities. Administrator can also update registration information. 8.5.2 Admin Login
Registered administrator can use different functionalities of system after login to it. To login to system user has to provide its ID and Password. This login information then verified from information already stored in database. If provided information is correct then user login to system otherwise administrator will receive an error message. 8.5.3 Category
Items are held or recognize under general categories. These categories can be added, removed or updated by administrator of system. 8.5.4 Item
Items are the one of the main component of system. Items are the product for sale and customer are interested in them. Items can be more
than
one
and
are
directly
comes
under
some
category.
Administrator of system can add, remove or update any item. 8.5.5 Report
Both administrator and customer require report from the system according to transactions made by them. These reports can be general purpose or specific purpose depends upon needs. Administrator needs report according to category or customer. While customer requires reports according to purchased item or according to purchased date, these reports can be printable. 8.5.6 Cart
Registered customer can login to system and browse available items. If they like any item or group of items, they can add them to the cart. Cart is a place which list down all the items selected by customer 36
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
and intended to purchase. A customer is an administrator of cart and can add or remove items from cart. 8.5.7 Checkout
If customer has done its shopping then customer requires to checkout. In checkout process customer is expected to pay for selected items in cart. System will show all selected items and total amount of money required to purchase them. System will also provide customer three ways of payment. Customer will select one of the payment method and pay for the chosen items.
Chapter 9 System Design 9.1 Introduction After system analysis there should be a way to represent analysis output to either user or system programmer. The method in which system designer presents its analysis and finding is known as System Design. It is also one of the most important outputs that are required to see before start of implementation process. System design has to be accomplished in
37
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
number of steps and techniques. In this project, most prominent and well used designing technique has been followed and these are:
9.2 Use Case Diagrams Chitnis et al (2007) have confirmed that use case diagram comes under the heading of behaviour modelling. It shows an interaction between components of system and their respective users. In use case diagrams there are two most prominent components that are compulsory in making of development of diagrams and these are
Figure 9.1 Use Case Diagrams After analysis of that system, two primary actors and many process components have been found. Interaction between actors and process components has been presented in two forms in section below. One represent whole of system actors, process components and their relationships. While others represent individual components with detailed interaction
between
system
actors
and
corresponding
boundary
shows
completely
component
processes. 9.2.1 System Boundary
System
processes, actors and their interaction.
38
set
of
component
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 9.2 System Boundary Diagram 9.2.2 Registration
Figure 9.3 Registration diagram Description: Register customer with the system so they can start buying items from portal. Triggers: Need of user to register with system.
39
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Inputs: 1. User registration information 2. Preferred Login ID and Password Outputs: 1. User registered to system 2. Or, error message Activities: User provides registration information and preferred login information. System will check whether such login id already exists or not and whether the password and login id are of correct form. If all information are correct then system encrypt registration information and gives user success message. Otherwise, system gives error message. 9.2.3 Login
Figure 9.4 Login Diagram Description: Register user wants to login to system to use its services. Triggers: Need of user to login into system. Inputs: 1. Login ID 2. Password Outputs: 40
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
1. Welcome to system 2. Or, error message Activities: User
provides
login
information
with
screen
keyboard
provided. Information will be compared with information, which is stored in encrypted form into system. Encryption and decryption both functions will be used to make information comparable. If information is correct then user login to the system else user receive an error message. 9.2.4 Category
Figure 9.5 Category Diagram
Description: Administrator alters item categories by adding, removing or updating them. Triggers: Need of management of item categories. Inputs: 1. Item category information 2. Management instruction Outputs:
Administrator
1. Operation carried out
41
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2. Or, error message Activities: Administrator enters or select item category and then give an instruction from a set of instructions like add, remove or update. System will validate instruction and item category and if all of these inputs are valid then system will carryout instruction. Otherwise an error message will be given to user. 9.2.5 Item
Figure 9.6 Item Diagram
Description: Administrator alters items status by adding, removing or updating them. Triggers: Need of management of items. Inputs: 1. Item information 2. Management instruction Outputs: 1. Operation carried out 2. Or, error message Activities: 42
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Administrator enters or select item and then give an instruction from a set of instructions like add, remove or update. System will validate instruction and item and if all of these inputs are valid then system will carryout instruction. Otherwise, an error message will be given to user. 9.2.6 Cart
Figure 9.7 Cart Diagram Description: Customer alters shopping cart status by adding or removing selected items. Triggers: Need of management of items in shopping cart. Inputs: 1. Cart and item information 2. Cart management instruction Outputs: 1. Operation carried out 2. Or, error message Activities: Customer review cart and shopping items, that have been selected and also other available items. The customer select item and give an instruction from a set of instructions like add, remove or update. 43
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
System will validate instruction and item selected and if all of these inputs are valid then system will carry out instruction. Otherwise, an error message will be given to customer. 9.2.7 Checkout
Figure 9.8 Checkout Diagram Description: Customer has done its shopping and now checkout from system by paying for selected items.
Triggers: Need of checkout after shopping. Inputs: 1. Selected items list 2. Selection of payment method 3. Payment Outputs: 1. Operation carried out 2. Acknowledgement of amount and shipping date 3. Or, error message Activities: Customer completes its shopping by selecting all desired items. Then customer selects checkout option. System will give customer 44
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
three options or three modes of payment. User will select one of them and then pay money accordingly. System will gives acknowledgement to user. If these things do not happen accordingly, then system will prompt error message. 9.2.8 Administration Report
Figure 9.9 Administration Report Diagram Description: System generates report for administrator either according to item category or by customer. Triggers: Need of generation of report for administrator. Inputs: 1. Administration reporting option 2. Reporting criteria (either by category or by customer) Outputs: 1. Operation
carried
out
and
reported
generated
for
administrator 2. Or, error message Activities: Administrator selects reporting option and also mode of report (either by category or by customer). If all selections or inputs are valid then system will generate report for administrator. Otherwise, system will display an error message. 45
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
9.2.9 Customer Report
Figure 9.10 Customer Report Diagram Description: System generates report for customer either according to item that customer purchased or according to date of items purchased. Triggers: Need of generation of report for customer. Inputs: 1. Customer reporting option 2. Reporting criteria (either by specific item or by date of items purchased) Outputs: 1. Operation carried out and reported generated for customer 2. Or, error message Activities: Customer selects reporting option and also mode of report (either by item or by date of items purchased). If all selections or inputs are valid then system will generate report for customer. Otherwise, system will display an error message. 9.2.10 Logout
46
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 9.11 Logout Diagram Description: User wants to logout from system and release session and all other resources. Triggers: Need to logout from system. Inputs: 1. User logout option Outputs: 1. User logged out 2. Session expired 3. Personal information removed from platform
Activities: Customer selects logout option to stop usage of services of system for the time being. User session will expire and all resources occupied by user will release. User personal information will be removed from utilizing platform.
47
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
9.3 Class Diagram Class diagram represents different class that has been identified during analysis process. It also shows relationship between classes. Class diagram for this project has been shown below: Perso n
1..*
-PersonID: string -Passw ord: string +T itle: string +F irst N am:estring +Last N a m :estring -R ole: string +R e gistratio()n +U p date In form ation () 0..* +Login/Log out() 1
1..* 0..*C u s to m er
A d m in istrato r -Privilag es +Ad d/R em ove /U p date C ate gory () +Ad d/R em ove /U p date Item () +Ge nerate R ep()ort
-Privilage s +M ana ge C hart () +Ad d/R em ove Ite m ()s +C he ckout () +Pa ym e nt ()
1..* R ep o rt -R e portin g Ele m ent : lo ng -T ype: string +Gene ra te R eport () +Prin t R e port ()
1
1
1
1..* 1..* Ite m C a te g o ry -C atID: long -N am e: string -Price: string +AddC ate gory () +D ele teC atego()ry +U pda teC atego()ry
1
1..*
-Item ID: long -C ateg ory : strin g -D ateOF M an ufacturin : string g -D ateo fSell +Ad dItem() +D eleteIte (m) +U pd ateItem () +Se llIT e m ()
1..* Pay men t M eth o d -M eth odID: long -T ype: string -N a m e: strin g +PayBills()
Figure 9.12 Class Diagram
Chapter 10 Implementation 10.1 Introduction Software development life cycle model of this project is water fall. Therefore, the next stage of development of this project is implementation of project. This is one of the most important stages and customer of this project would be more interested in this stage than any other. Whole of the previous analysis and design activity leads toward this important 48
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
stage. Implementation of project does not composed of only coding of system. As it is the most critical stage of project development, so many important decisions have to be made on this point. It would be difficult to discuss all of them in this documentation. But few critical aspects have been discussed in section below.
10.2 System Mode Any project can be developed in two modes and these are either console based application mode or web based mode. Both of them got their own powers and weaknesses and choice of any of them depends upon the type and demand of project. Before selection of system mode it would be necessary to give brief overview of both of them.
10.2.1 Console Based Application
Console based applications are such applications which normally available on disks or internet website. They came in an installation form. Once they installed on a system then they will become a part of it and they do not required to install again upon usage after first installation. Users are quite familiar with such sort of systems and they do not require constant help or guidance of usage from developers. Normally such applications come with helping contents which are guidelines to use the system. These applications are quick and consistent because they installed on user system and they do not need to download interface on each transaction. They applications do not need constant internet connections to carryout there task or to start up a system. But on some critical occasions they need internet connection to collect live information. Along with many advantages there are some disadvantages of console based applications which sometime hurts their popularity. These are as follow 1. Console based applications require constant upgrades and maintenance and they are not easily available. Vender of such application publishes them on disks or either places them on websites. But user has to manually download these updates or patches and install them. Their installation is not automatic in most cases. 2. If they have to present information from website. Then they would become useless without internet availability. 3. They are expensive. 49
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
4. Sometime they are complex when they built for a specific purpose.
10.2.2 Web Based Application
Web based application are those application which are available on internet. They do not require any installation. They work like any general website and serve the purpose of organization that requires it for their specific purpose. As a website does not requires any installer then it is also not require for a website to be installed on computer. Website consists of web pages which express information which an organization wants to deliver to its user. There are also some other interactive pages which request user to input any information required by system and then reply back with results accordingly. Web base applications are easier for user to work on, to browse information, and to send information. Users are quite familiar with format of websites and they prefer to browse information on them because they are now become a common tool. Along with many advantages of web base application there are some disadvantages which might affect its popularity and these are: 1. Web based applications are completely useless with internet and they can not provide anything if a system does not have an internet connection. 2. Web based applications are slow because on each transaction a computer needs to download not only the data but also the interface. 3. Its speed also depends upon complexity of each transaction and internet speed.
10.2.3 Chosen Mode of Application
Web base application mode has been selected because this is an online shopping system and it does not require user to install this application on their system. Application should be available on all places. Business has to made and run on internet as this is a prime demand of online business systems. This organization does not want their users to upgrade system and it requires thing to change on one (server) end. All other users are only required to use this portal and they should not be worried about any upgrades or patches.
50
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
10.3 Programming Language 10.3.3 ASP.NET
According ASP.NET Web site ASP.NET was a pioneer dynamic web development language. That language has opened a new horizon of ways of transferring information from internet. That language has made it possible for many organizations to handle their businesses through internet and increase their income circle and customers through out the world. ASP.NET is an extension of ASP which includes all the basic features provided by Asp along with some new astonishing functionality. This language is also considered as one of the most advanced and matured programming language. Many websites have been developed in it. This language also has a great set of libraries which poses solution of every problem. This language make life of programmer quite easier because programmer does not need to seek helps from different other sources. The helping section of this programming language is called MSDN. This helping program ask programmer to insert searching keyword, after this the helping program find relative information from not only the locally store information but also from all other prominent forums and websites. Else then the helping program there are thousands of other forums and developer portals which can give advice on problem of any complex nature. This language is quite easier to learn. An average programmer needs nearly one month to became more than average programmer in this development language. As this language assist programmer during development process, so programmers do not need to memorize each syntax and programming routine. ASP.NET came with an excellent development tool known as Visual Studios.NET. This development tool is quite easy and helpful. It assist programmer in development of program of any complex nature. A programmer can develop its program quite quickly in this development environment. After careful consideration of situation and needs of application, it has been decided to use ASP.NET 2.0 for the development of this program. Choice of this language has been made because of many facts which includes: 1. Author does not have much time to learn any new language as author got a good hand in chosen language. 2. Author does not have much time to complete this task and this language promise a quick development of any solution.
51
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
3. Author finds it easier to develop and deploy its solution in this programming language.
10.4 Database Management System 10.4.1 Introduction
This project requires usage of any more than average database management system. Like programming languages there are many database management systems that author can choose for this project. Every database management system got its own positive and negative points but each of them serves the purpose of storage and retrieval of information. Author has chosen SQL Server as a database management system for this project because ASP.NET and SQL Server has been manufactured by same company. They both support each other and Asp has many built in routines which made connection to database easier and efficient. Retrieval of information is straight forward and dataset objects made it possible to store result of query and then use it without connecting to database again. SQL Server can store large amount of information and searching mechanism of SQL-Server is far more advance and good.
10.4.2 Coding
Implementation of project is composed of set code which carryout certain task. There are few coding conventions which are universal and should be followed by each development team in order to make their project more versatile and acceptable. If a development team follows coding conventions and rules then if they are not able to develop certain functionality at the present, then those functions can be develop later on by other development team. It would be rather easier for other developers to understand and extend existing code. Else then coding conventions and ways of development of programming functions, this section also includes important coding chunks which are vital or the main driver of this program.
52
Mansour H. Almalki
•
MSc. Internet computer and System Security, 2007
Encryption Function To implement encryption function a key has been made and saves in the
database and only administrator of system can make and save that key. A Hash function format of that key is MD5. In the field of MD5 (Message Digest Algorithm 5) is well known and most used hash function. It is composed of 128 bits hashed value. MD5 is mostly used in different form of security applications. The main cryptographic technique that has been used in this system is (3DES). TripleDes is known (Triple Data Encryption Algorithm) which used hashed key in MD5 format and Administrator provided information to be encrypted. Then with these parameters encryption function encrypt the information and provide this information to other functions so that they can save it in database. Triple Des is composed of 168 bits storage length and it is one of the most secured and recommended form of encryption. Code below shows the general encryption function used for this program that has shown by Stallings (2003).
Protected Function EncryptFunction(ByVal toEncrypt As String) Dim keyArray() As Byte = fetchKey() Dim UTF8Encoding.UTF8.GetBytes(toEncrypt)
toEncryptArray()
As
Byte
=
Dim tdes As New TripleDESCryptoServiceProvider tdes.Key = keyArray tdes.Mode = CipherMode.ECB tdes.Padding = PaddingMode.PKCS7 Dim cTransform As ICryptoTransform cTransform = tdes.CreateEncryptor() Dim resultArray() As Byte cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length)
=
tdes.Clear() EncryptFunction = Convert.ToBase64String(resultArray, 0, resultArray.Length) End Function
The fetch key function collects encrypted key from database and provide it to encryption function for use. 53
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Protected Function fetchKey() Dim myConnection As SqlConnection Dim myReader As SqlDataReader Dim myCommand As SqlCommand Dim key() As Byte = {11} myConnection = New SqlConnection("Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=cryptography;Data Source=MEHBOOB\SQLEXPRESS") Try myCommand = New SqlCommand("select * from CrytoKey",
myConnection)
myConnection.Open() myReader = myCommand.ExecuteReader() If myReader.HasRows Then myReader.Read() key = myReader("SecretKey") End If myConnection.Close() Catch ex As Exception End Try fetchKey = key End Function
•
Decryption Function Decryption function required a parameter which is composed of a value that
needs to be decrypted. Encryption function fetch encrypted key from database and then with that key decryption function decrypts encrypted parameter and returns a human readable (alphanumeric) value. Code below shows all steps that need to decrypt a value.
Protected Function DecryptFunction(ByVal cipherString As String) Dim keyArray() As Byte = fetchKey() Dim Convert.FromBase64String(cipherString)
toEncryptArray()
Dim tdes As New TripleDESCryptoServiceProvider
54
As
Byte
=
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
tdes.Key = keyArray tdes.Mode = CipherMode.ECB tdes.Padding = PaddingMode.PKCS7 Dim cTransform As ICryptoTransform cTransform = tdes.CreateDecryptor() Dim resultArray() As Byte cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length)
=
tdes.Clear() DecryptFunction = UTF8Encoding.UTF8.GetString(resultArray) End Function
•
Screen Keyboard This keyboard has been provided to increase security of this system. Sometime
hacker of intruders read combination of keyboard and figure out data input by user. That data can be quite useful and important and it might compose of user name, password and date of birth etc. Security is one of the prime requirements of this website so it is decided to make a screen keyboard which would reduce the impact of hacking and make this system more secure. Code below shows only few important aspects of screen keyboards as it is not possible to elaborate everything here.
function addCharacter(ch){ document.frmTyping.CtrTextfield.value
=
document.frmTyping.CtrTextfield.value+ch; } function addAlphaCharacter(ch){ document.frmTyping.CtrTextfield.value document.frmTyping.CtrTextfield.value+document.getElementById(ch).innerHTML; }
function clearField(){ document.frmTyping.CtrTextfield.value = ''; }
55
=
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
function backSpace(){
fieldValue = document.frmTyping.CtrTextfield.value document.frmTyping.CtrTextfield.value = "";
for(var z=0;z
=
document.frmTyping.CtrTextfield.value + fieldValue.charAt(z); } }
These are few general-purpose functions, which deal with click events of user on screen keyboard. Normally this keyboard works just like a normal keyboard that user got as a peripheral device with its computer. User has to select keys from onscreen keyboard with mouse or touch pad rather than typing it.
10.4.3 Project Interface with Description
It is a big program and it would be very difficult to draw and explain each screen. However, in the section below few important interfaces of system has been illustrated and discussed. This section would be helpful for new users who do not know much about system and this section will serve as an introduction to interface of this project. •
Login This is a main page where a user can login to the system if it has valid login
information comprising of valid login and password. If user enters a valid login information then system will log user in otherwise system will display alternative message.
56
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.1 Login Form
•
Onscreen Keyboard This is an onscreen keyboard which has been made for security reasons and
main purpose of this page is to reduce amount of attack and threats to this system because many hacker try to hack keyboard key and attain valuable information. This control can be called from different pages. On the other hand, functionality of this control is similar wherever it is being used.
57
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.2 Onscreen Keyboard Form
•
Adding New Category Category is like a general name for group of object or items which shows
similar behaviors. Categories are also names of group of brands from different companies. For example, watch is a category while SWISS watches, RADO watches or SEIKO watches are the names of brands under category watch. This page let user (administrator) to define new category.
58
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.3 Adding New Category Form
•
View and Update Categories This page will display all categories currently handled by this website. User
(administrator) will be able to view details of already added category. There is also one like against each category and it is named as “update”. From this like a user can update information any category.
59
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.4 View and Update Categories Form
•
Add New Item This is a page where an administrator can add a new item against any
category. This item will then be available for customer to purchase. To add a category, administrator has to provide item title, description, price, type of category, two picture (big and small) which will be display against category and customer can see it and quanity of item.
60
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.5 Add New Item Form
•
Add Item to Cart This page will be visible in customer login. A customer can view information
regarding any item in particular category. Customer can see items pictures and it quantity. Customer can then add item to its cart. Customer will be able to view its cart all the time while doing its shopping.
61
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.6 Add Item to Cart Form
•
Checkout Customer after done its shopping can select checkout option. In checkout page
a customer can see all items in cart and their total price. Customer can also remove any item if it does not require. This page also contains three further options of payment which are payment by card, by bank draft or by cheaque. Customer must has to select any one of them and pay for its shopping.
62
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.7 Checkout Form
•
Report Customer and administrator both are interested in this section. Report that will
be represented in this section shows customer purchasing history. This page shows all the items that customer has purchased from this website.
63
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Figure 10.8 Report Form
Chapter 11 Testing 11.1 Introduction Once a project has been developed it is required to test it thoroughly to ensure that it is giving up most output. Testing of system is a big task and requires careful designing of test with proper execution of testing process. It is a long a process and requires patience, expertise to cater out delay and gather all required information. In process of testing all important and prominent aspects has been tested and well evaluated. Results of these testing were satisfying and give development team more confidence to carry on good work. 64
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
11.2 Test Plan Test plan is a formal testing activity for the validity of any system. For this purpose project team has to develop several test plans according to certain important areas which require careful review of users. These test plans have been developed and executed. Their numbers are quite high and it would not be a nice idea to explain all of them in this documentation. Therefore, only few has been chosen and represented for the sake of clarity and conciseness. All test paln will be available on the appendix.
Chapter 12 Conclusion 12.1 Introduction I try my best to make this project as exist real project which can any company use it as Business to Consumer Web site including all security mechanism that I learnt at Bradford University or my experience on my life. However, the main purpose of this project was to learn understand the new security knowledge that use in E-commerce and what the newest of it. This project is given a valuable knowledge of initiation of project, understanding the requirements, making analysis, design, implementation, testing, and documentation. Understanding and experience in all these features are fundamental for any business Web site to start and develop a successful career. Along with some personal gains with the third party provider (Godaddy Company www.godaddy.com ), the author make a deal with this company to host the Web site and
65
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
make a SSL certificate to understand that technology virtually. In addition, how different types of security system, which the third parties can, provides.
12.2 Critical Assessment How do you like to shop? Do you prefer shopping in the Internet? If yes, do you use your credit card or third party for payment, if no is the security, which offered by the shopping Web site not enough. There are millions of consumers on the Internet and the big issue for them is how they can pay in securely and how they do not be in incurrence of fraud. Sometimes it is a consumer fault, as he does not take care of logoff from the Web site. On the other hand, it could be a company fault when they do not Use SSL.
This project has appeared to cover
completely that argument.
12.2 What have been done Project of business to consumer’s Web site that is sold electronic equipments. Three Web sites have taken as an example Boots, Dixons and Flowers direct. Moreover, the security advantage and disadvantage has been taking as well as the new security standards in the market. However, this Web site includes sort of security mechanisms as follows: • •
• • •
•
SSL certificate. Encryption the sensitive database. Avoid SQL injection attack. On-Screen Keyboard. Password policies. Session security.
66
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
References Norris, M. and West, S. 2001 EBusiness Essentials. John Wiley & Sons Ltd, England Turban, E., Cohen, C., Copi, I. M. and King, D. R. 2003 Introduction to E-Commerce. Pearson Education, NJ, USA Moroney, L. and MacDonald, M. 2006 Pro ASP.NET 2.0 in VB 2005, Special Edition (Pro), Apress, Berkely, CA, USA SQL Injection Techniques & Countermeasures by Pankaj Sharma www.cert.org.in/knowledgebase/whitepapers/ciwp-2005-06.pdf Rajput, E. 2000, E-Commerce Systems Architecture and Applications. Artech House, Norwood, USA Khusial, D. and McKegney, R. 2005 E-Commerce security: Attacks and preventive strategies http://www.ibm.com/developerworks/websphere/library/techarticles/0504_ mckegney/0504_mckegney.html#author Sharma, P. 2005 SQL Injection Techniques & Countermeasures, available on www.cert.org.in/knowledgebase/whitepapers/ciwp-2005-06.pdf SANS Institute. 2006 Password Policy, available on www.sans.org/resources/policies/Password_Policy.pdf Martin, F. 2002 SSL Certificates HOW TO, available on http://tldp.org/HOWTO/SSL-Certificates-HOWTO/x64.html VeriSign, available on http://www.verisign.com/ssl/ssl-informationcenter/strongest-ssl-encryption/ EV SSL, availbal on http://www.microsoft.com/windows/products/winfamily/ie/ev/default.mspx
Cooper, p. 2002 Merchant Account Tutorial available on http://www.findmerchant.com/merchant/merchant_tuto5.htm PayPal. Payflow Payment Gateway available on https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-gateway67
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
overview-outside WebSphere Commerce Information Center 2005 Offline payment cassettes available on http://publib.boulder.ibm.com/infocenter/wchelp/v5r6m1/index.jsp?topic= /com.ibm.commerce.payments.developer.doc/concepts/cpyofflp.htm Mitchell, S. 2005 Encrypting Sensitive Data in a Database available on http://aspnet.4guysfromrolla.com/articles/081705-1.aspx Parekh, N. 2005, The Waterfall Model Explained available on http://www.buzzle.com/editorials/1-5-2005-63768.asp Mochal,T. 2001, Gathering business requirements available on http://articles.techrepublic.com.com/5100-22-1045549.html Chitnis, M., Tiwari,P. and Ananthamurthy,A., 2007 Creating Use Case Diagrams available on http://www.developer.com/design/article.php/2109801
,
ASP.NET available on http://www.asp.net/ Stallings, W.,2007 Network Security Essentials: Applications and Standards, Third edition, Prentice Hall Pay flow Payment Gateway available on PayPal Web site available on https://www.paypal.com/us/cgi-bin/webscr?cmd=_payflow-gateway-
overviewoutside&nav=2.0.3 Free Online Voucher Codes, Free Discount Codes, Free Coupons & Free Promotional Codes available on www.vouchercodes.com.
68
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
APPENDICES Appendix A Test plan
Test Plan No. 1 Program:
Customer
Version number: 5.1
Registration Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify Encryption Function Objective: Ensure that Encryption function works properly Program
Field
Values
Customer Registration
Registration ID
Blank
Customer Registration
Registration ID
ABC
Customer Registration
Registration ID
123
Customer Registration
Registration ID
#####
Customer Registration
Registration ID
Binary
encrypted
value
according to key Expected results: It is expected that ‘Binary encrypted value according to key’ is valid (because this is one of core security requirements of this system is to produce and save encrypted registration information)
69
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 1
Test Plan No. 2 Program: Login
Version number: 5.1
Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify Decryption Function Objective: Ensure that Decryption function works properly
Program
Field
Values
Login
Password
Blank
Login
Password
#####
Login
Password
123
Login
Password
Binary
encrypted
according to key Login
Password
70
Mansoor123
value
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Expected results: It is expected that ‘Mansoor123’ is valid (because it is the same value which user has provided to system and system encrypt it and save in database, it also correct because it fulfil the criteria of password which should be more than six characters)
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 2
Test Plan No. 3
Program: Screen Keyboard
Version number: 5.1
Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify Screen Keyboard Objective: Ensure that screen keyboard work properly without any error
Program
Field
Values
Screen Keyboard
Input Field
Blank
Screen Keyboard
Input Field
‘A’
instead
of
‘a’
chosen from keyboard Screen Keyboard
Input Field
No blank input
Screen Keyboard
Input Field
Exact
values
as
selected from keyboard Expected results: It is expected that ‘Exact values as selected from keyboard’ is valid (because it is the screen keyboard which should represent actual keyboard and should provide almost all important keys, it should be able to differentiate and accept caps alphabets, numeric and blank spaces)
71
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 3
Test Plan No. 4 Program: Checkout
Version number: 5.1
Tester: Mansour
Dated: 21-12-2007
Requirements Tested: Verify payment method Objective: Ensure that payment request goes to one of the payment methods supported by this system
Program
Field
Values
Checkout
Payment Method
Cash
Checkout
Payment Method
Not available
Checkout
Payment Method
Card, Pay pal, Cheque (according to selection of user)
Expected results: It is expected that ‘Card, Pay pal, Cheque (according to selection of user)’ is valid (because valid payment method is one of them, any other form of payment will not be accepted by this system)
72
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Actual results: System works according to the standards set for it.
Table Appendix A Test Plan No. 4
Appendix B The interview questions with its results Q.1) What are the number of items you want this website to support? Number of items is not fixed, as we want to add and remove items according to market situation. Some time it happens that certain items got more popularity and demand then others so in that case we want to shuffle the most demanded item with the least demanded item. Q.2) What are the number of roles you want this website to support? There are only two types of roles that we want this system to support and these are 1. Administrator 2. Customer Q.3) What should be the functions of these roles? Administrator: 1.
Has to announce different type of categories and items to sell.
2. Set price for each item. 3. Is also responsible to enter quantity of each item. 4. Should monitor each customer. 5.
Produce report about each customer and his payment, which they spent. 73
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
Customer: 1. Can view different items, their details, quantity and price. 2. Has to add item to cart. 3.
Has to pay money with three different ways to purchase the items.
4. Review report about each transaction. 5. Review report about all items purchased. Q.4) What would be payment ways for customers to pay money? There are three popular ways to pay money for items that user purchase. These are very well known ways of transaction of money and normally a user may be in use with one or all of them. These ways of paying bills are as follow: 1. Pay pal 2. Card. 3.
Cheque or bank draft. Q.5) What sort of the security threats that you are worried
about? Security is one of the key requirements of such sort of system. It is a business application and every now and then users have to purchase item and send money in any of the above three forms. It would be worse 1. If someone break through the system and collect valuable information regarding user. 2. If someone redirect purchase item to wrong location. 3. If someone hack the website and cause business losses. Q.6) Which areas would you like to protect more? Although it would be admired if everything would develop according to some standards. Information should be process safely. However, it would be best if following list might be protected. 1. Input of information should be in any secure form. 74
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
2. Information should transmit safely over network or network of networks. 3. Information should be saved in database in disguised format.
Appendix C The interview questions with its results Q.1) Would it be better for you to have a screen keyboard from where a user does not has to enter any entry, user just has to select figures or letters with mouse or touch pad (this would be better for security purpose as many spy programs reads keyboard input and send them to dangerous person)? Nearly 90% of users agree with this idea because they want their information to be transmitted and processed in safe environment. Nearly 10% of user does not agree with this idea because they think that keyboard is much quicker then mouse or touch pad and it would waste time of those users who do not want to use keyboard. Q.2) Would you like your information to be encrypt in a way that no one can read or understand it. Only this program holds a key (which is also resided in encrypted form) to descript that information and show it to user? Nearly
95%
of
users
agree
with
this
duel
encryption
mechanism. They believe that by this way there information can be safer and no one can break in to system. While 5% still believe that there would not be any security threat and this mechanism would decrease speed of processing because of extra effort requires to read and decrypts key and then uses it to decrypt other information hold by system. Q.3) Would you like to have report of all items purchased by you?
75
Mansour H. Almalki
MSc. Internet computer and System Security, 2007
96% says yes which 4% says no.
Q.4) Would you like to have a validation mechanism which will ensure that those items which are out of stock should not be placed on shelf to sale? 90% says yes to this question because it would save time and efforts of user by taking their attention away for finished products. 10% says no to this question because they want to know information regarding all items irrespective of their availability. Q.5)
Would
you
like to
have some
sort
of reporting
mechanism which can assist administrator to get report according to item or customer and can assist a customer to get report according to item of date of purchase? 85% says yes to this and believe it is a nice idea which can keep them informed about their business history. While 15% says no because they believe that there is no need of report because a customer or either an administrator just interested in what is the current situation of business
76
Related Documents
Mans Our
May 2020 16
Mans Our
July 2020 8
Mans Ha
November 2019 32
Moses Mans
November 2019 34
New Mans
June 2020 21
Mans Field
June 2020 11More Documents from ""
Mans Our
July 2020 8
Chevrolet S/t Truck Incomplete Vehicle Document
April 2020 1
Mutiara Hadis
May 2020 30
Surat Cinta
May 2020 21
Sabar Dan Kejayaan
May 2020 28