E-Commerce Security (Paperback)

Chapter one is a general introduction to the factors involved, looking at some recent "attacks" of various types, and then reviewing the client, transport, server, and operating system components to be examined in the remainder of the book. Client (generally browser) flaws are covered thoroughly in chapter two. The breadth of coverage even includes mention of topics such as the concern for privacy considerations with cookies. Active content is the major concern, with an excellent discussion of ActiveX (entitled "ActiveX [In]security"), a reasonably detailed review of the Java security model, and a look at JavaScript. Unfortunately, very little of this touches directly on e-commerce as such, except insofar as insecure client technology is going to make e-commerce a harder sell to the general public. While covering the transport of transaction information, in chapter three, Ghosh makes an interesting distinction between stored account systems (where you want to secure the transmission of identification data) and stored value systems (where the data, once transmitted, is useless to an eavesdropper). Many books concentrate on either channel security or electronic cash systems, so this comparison is instructive.

A server involves multiple programs, and may involve multiple machines. Server security can quickly become complex, and this is quite evident in chapter four. While a great deal of useful and thought-provoking information is presented, the complicated nature of the undertaking works against this chapter. Not all topics are dealt with thoroughly, or as well as the previous material was. Oddly, one issue not covered in depth is the firewall, which is handled very well in chapter five, with operating system problems. Ghosh sets up a classification scheme for OS attacks, illustrated by specific weaknesses in Windows NT and UNIX.

The book ends in chapter six with a call for certification of software, greater attention to security in all forms of software, and, interestingly, for greater use of component software. (From the jacket material, it appears that Ghosh is currently involved in the promotion of component software systems.)

Each chapter ends with a set of references. Unlike all too many books with bibliographies stuff with obscure citations from esoteric journals, the bulk of the material listed is available on the Internet. A separate section lists Web sites used in the text.

The various issues dealt with in the book are explained clearly, and generally present counsel on the best practices for secure online commerce. A compact but comprehensive guide to the current state of electronic transaction security.