E-Commerce Security [Paperback]

Online security investigator and research scientist Anup Ghosh takes a realistic look at the state of security for electronic commerce. He is neither a Pollyanna believing that all is fine, nor a doomsayer predicting catastrophe for transactions lacking virtual armour. In fact, he feels that some levels of security are excessive. But he emphasises that any security system is only as strong as its weakest point. If you're going to trust your money to online transactions, you need to know where your weaknesses lie and how to correct them.

To that end, Ghosh discusses real-life security failures, how they occurred and how recurrences can be prevented. He then takes a systematic look at the areas of risk. One chapter deals with potential problems in active Web content, such as Java applets, ActiveX controls and push technology. He examines data protocols to secure transactions with the warning that the data can be vulnerable before and after the secure transmission. The weaknesses of server hardware and software come under scrutiny as well. Ghosh calls for greater attention to security as software and looks at what advances are likely to be coming down the road. --Elizabeth Lewis

"This is a very important book . . . mandatory reading for anyone thinking about getting into e–commerce."–Peter G. Neumann Moderator of the Risks Forum and author of Computer Related Risks

The World Wide Web is changing the way the world engages in business. With this paradigm shift comes uncertainty about how secure e–commerce transactions are over an inherently insecure medium–the Internet. Businesses have learned the hard way that there is no "silver bullet" solution–not encryption, not firewalls, not even secure protocols. Like a chain, the security of e–commerce is only as strong as its weakest link.

Written by security expert Anup K. Ghosh, E–Commerce Security highlights the weak links and provides best defenses for individuals and enterprises connected to the Internet. This valuable guide addresses vulnerabilities in four essential components of electronic commerce–the data transport protocol, Web server, Web clients, and the network server operating system.

E–Commerce Security:
∗ Exposes the dangers of new Internet innovations in today′s Web browsers, including push technology and desktop integration with the Internet
∗ Methodically explains the dangers of active content programs downloaded from Web sites, such as Java applets, ActiveX controls, and JavaScript
∗ Provides a comparison of different secure protocols for e–commerce, including digital cash protocols used in smart cards
∗ Presents security considerations for Web servers, online databases, and server–side application software
∗ Details shortcomings in firewall technology and other host security measures.

Visit our website at www.wiley.com/compbooks/

Visit this book′s companion website at www.rstcorp.com/EC–security.html.

Praise for " E-Commerce Security:Weak Links, Best Defenses"
"This is a very important book. It deals with the realistic security problems of electronic commerce, in which the weak links are ubiquitous and the best defenses known today are only partial solutions. It is mandatory reading for anyone thinking about getting into e-commerce, because otherwise you will be enormously at risk."
--Peter G. Neumann, Moderator of the Risks Forum and author of "Computer-Related Risks".

"Clear, lucid, right on target, and comprehensive...Anup Ghosh covers all major categories of digital risk, including client software, transmissions protocols, web-commerce servers and the operating system. If you manage any part of an organization's Internet connection, you owe it to yourself to read this book. "
--Peter Tippett, M.D., Ph.D. President, ICSA (International Computer Security Association)

"As business blossoms on the Net, technology professionals are hard pressed to keep up with the attendant security threats. Anup Ghosh knows the territory. His expert survey of the technologies, the war stories and the available resources is required reading."
--Benjamin Wright, Attorney and author of "The Law of Electronic Commerce".

"Anup Ghosh has produced a comprehensive and balanced treatment of e-commerce security issues that addresses the risks at all points of the link between buyer and seller. His readable and realistic analysis explores, not just the vulnerabilities of the network, but also the loopholes in client and server software and operating systems. In this rapidly changing environment, "E-Commerce Security: Weak Links, Best Defenses" is an up-to-date appraisal: Ghosh goes well beyond the obvious threats to illuminate many issues that deserve the thoughtful attention of corporate e-commerce architects."
--Peter Coffee Advanced Technologies Analyst, PC Week Labs

"This book is a comprehensive guide for anyone who is concerned about security risks associated with E-commerce."
--Aviel D. Rubin Secure Systems Research Department AT&T Labs

"The book is to the point, easy to read, comprehensive, and up to date. It deals with an issue of critical importance to anyone contemplating or involved in business on the Internet. Explanations are exceptionally clear."
--M.E. Kabay, Ph.D. Director of Education ICSA (International Computer Security Association)

"This is a very important book . . . mandatory reading for anyone thinking about getting into e–commerce."–Peter G. Neumann Moderator of the Risks Forum and author of Computer Related Risks

The World Wide Web is changing the way the world engages in business. With this paradigm shift comes uncertainty about how secure e–commerce transactions are over an inherently insecure medium–the Internet. Businesses have learned the hard way that there is no "silver bullet" solution–not encryption, not firewalls, not even secure protocols. Like a chain, the security of e–commerce is only as strong as its weakest link.

Written by security expert Anup K. Ghosh, E–Commerce Security highlights the weak links and provides best defenses for individuals and enterprises connected to the Internet. This valuable guide addresses vulnerabilities in four essential components of electronic commerce–the data transport protocol, Web server, Web clients, and the network server operating system.

E–Commerce Security:
∗ Exposes the dangers of new Internet innovations in today′s Web browsers, including push technology and desktop integration with the Internet
∗ Methodically explains the dangers of active content programs downloaded from Web sites, such as Java applets, ActiveX controls, and JavaScript
∗ Provides a comparison of different secure protocols for e–commerce, including digital cash protocols used in smart cards
∗ Presents security considerations for Web servers, online databases, and server–side application software
∗ Details shortcomings in firewall technology and other host security measures.

Visit our website at www.wiley.com/compbooks/

Visit this book′s companion website at www.rstcorp.com/EC–security.html.

ANUP K. GHOSH, PhD, is a research scientist with Reliable Software Technologies (www.rstcorp.com). He is an expert in security analysis of web–based applications and web servers. At RST, he is a principal investigator on a research contract with the National Institute of Standards and Technology investigating the security of the software components used in electronic commerce. He is also a principal investigator on a research contract with the U.S. Dept. of Defense investigating how to protect desktop systems from information warfare attacks.