Pretecting and archiving data

1.What makes a firewall a good security investment? Accessing the Internet, find two or three firewall vendors. Do they provide hardware, software or both?


Ince (2005) notes that a firewall is an extra layer of protection placed around a network or around a particular application. A firewall placed around a network will usually employ a router which can be programmed to deny access to a network, for example it can be programmed to deny access to any packets of data which have been sent to a particular dedicated port. The following diagram illustrates the operation of a simple firewall.Figure 1 A Simple Firewall (Ince 2005 Fig. 11.2)

My firm employs Check Point and WatchGuard as the firewalls for different sites. I myself installed Norton 360 developed by Symantec Corporation on my home machines, which also has the firewall facility. These three firewall products can possibly meet the needs of users from different markets. Check Point is very popular software firewall for enterprises and WatchGuard is a hardware firewall welcomed by SMEs. Norton 360 is a home anti-virus software that also acquires the personal firewall.

2.Find out if your university or workplace has a backup policy in place. Is it followed and enforced?

My firm certainly has a backup policy which is thoroughly implemented. It has multiple backup devices including magnetic tapes and optical disks. They just barely meet our needs and are still manageable. Apart from that, everyday we used up a few backup tapes and optical disks and as time gone by we have accumulated a huge volume of them. Therefore, the metadata of tapes and disks are getting more and more important, which highly affects the recovery process. We all know that the recovery of data is very time consuming and never an easy task. However, we are usually required to fulfil the requests from users with a tight time frame. As a result, this is crucial to implement an effective backup and recovery solution with holistic view.

3.Most of the antivirus software perform an active scanning of the user activity on the Internet, detecting downloads and attachments in e-mails. Hackers have readily available resources to create new viruses. How easy is it to find a virus writing kit?

From the given website, it doesn't take long for someone to create a virus. I just recall what happened about 9 to10 years ago. The 'ILOVEYOU' virus successfully attacked tens and thousands of computers around the world. It created super email storms over the networks in order to give denial-of-service (Dos) attacks to email services. The virus wass actually a simple VB program. After we had analysed the source code of the program, my colleague worked out a solution within 24 hours. The solution was to cheat the virus that the machine had got infected and therefore, it would not execute itself. How? The infected machine would have been inserted a registry key by 'ILOVEYOU' and the virus only attacked the computers wiithout this key. We inserted this key to all computers on the network as a 'vaccine'. According to Wikipedia (2009), 'ILOVEYOU' infected10 percent of all computers connected to the Internet.

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp. 321-322

Wikipedia 2009, ILOVEYOU, Wikipedia, The free encyclopedia, last modified 28 May 2009, Wikimedia Foundation, Inc., US, viewed 12 June, <http://en.wikipedia.org/wiki/ILOVEYOU>.

Electronic payments and security II

1.What are cookies and how are they used to improve security?

Ince (2004) notes that 'a cookie is a file which is placed on a client running a browser and which usually contains details of a particular transaction, for example the products which someone has bought from an e-tailing site.'

According to Wikipedia (2009), there are a few uses of cookies.

• Cookies were introduced to provide a way to implement a shopping cart a virtual device into which a user can store items they want to purchase as they navigate the site.
• Cookies allow the server to know that the user is already authenticated, and therefore is allowed to access services or perform operations that are restricted to a user who is not logged in.
• Many websites also use cookies for personalization based on users' preferences.
• Some websites use the cookies to track internet users' web browsing habits for on-line advertising purpose (e.g. Google).

Users typically log in by inserting their credentials into a login page; cookies allow the server to know that the user is already authenticated, and therefore is allowed to access services or perform operations that are restricted to a user who is not logged in. In this sense, cookies become the authentication token of users' login.

2.Can the use of cookies be a security risk?

In general, a cookie itself is not dangerous. They may potentially infringe upon the host's privacy, but they are easily removed. A tracking cookie cannot cause any system instability. However, the use of cookies might trigger the following security risks.

• Inaccurate identification - this problem might arise when multiple users share the same user account on a computer.
• Cookie hijacking - attackers can use packet sniffing to steel the cookies which are being sent back and forth over the unencrypted http connections and then, intercept the cookies of other users and impersonate them on the relevant websites.
• Cookie theft - by design the cookie specifications constrain cookies to be sent back only to the servers in the same domain as the server from which they originate. However, the client-side scripts can redirect the values of cookies to a different server. Thus, the attackers can collect the cookies of other users.
• Cookie poisoning - while cookies are supposed to be stored and sent back to the server unchanged, an attacker may modify the value of cookies before sending them back to the server.
• Cross-site cooking - this is similar to cookie poisoning, but the attacker exploits non-malicious users with vulnerable browsers, instead of attacking the actual site directly. The goal of such attacks may be to perform session fixation.
• Inconsistent state on client and server - the use of cookies may generate an inconsistency between the state of the client and the state as stored in the cookie. If the user acquires a cookie and then clicks the "Back" button of the browser, the state on the browser is generally not the same as before that acquisition.
  

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp. 305-306.

Wikipedia 2009, HTTP cookie, Wikipedia, The free encyclopedia, last modified 3 June 2009, Wikimedia Foundation, Inc., US, viewed 7 June 2009,<http://en.wikipedia.org/wiki/Intrusion_detection_system>.

Electronic payments and security I

1.List and describe your experiences with a secure Web site.

Very often I use online banking services to settle my bills and manage my financial transactions. HSBC online banking website adopted two-factor authentication and is equiped with EV SSL certificates. Not only I need to logon it with my user id and password but also, enter a one time password generated by the given hardware token. The password is only effective for 15 seconds.

I have experience of purchasing goods from Amazon. When I make a payment for the selected items, I will have to sign in the secure server for processing the transaction. Hypertext Transfer Protocol Secure (HTTPS) is adopted in the payment module of the Amazon website. There are a few methods to settle the payment. I have chosen the credit card option in my account since day one.

2.What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?

Secure Electronic Transactions (SET) is a protocol which is used for sending credit card information over the Internet. It consists of three major components: Electronic Wallet, SET Server and Payment Server. For details, please refer to my previous blog entry.

Both SET and SSL employed Cryptography to secure the information exchanged over the Internet. This would be tremendous important for online transactions. SET was launched in 1996 but was not very popular in the market even though 'SET was ultimately the strongest technology for securing online payments, businesses tended toward the less sophisticated models as a means of establishing for themselves an online presence' (Free Encyclopedia of Ecommerce n.d.).

Wikipedia (2009) explains why SET could win the market due to the following factors:

• Network effect - need to install client software (an e wallet).
• Cost and complexity for merchants to offer support and comparatively low cost and simplicity of the existing SSL based alternative.
• Client-side certificate distribution logistics.

Free Encyclopedia of Ecommerce (n.d.) also claims that SET is a sophisticated model but users favour the less sophisticated model, SSL. Nowadays, SSL has been the most popular protocol for securing e-commerce transactions. Lee, Malkin & Nahum (2007) have evaluated the adoption and evolution of Secure Sockets Layer (SSL)/ Transport Layer Security (TLS) through 19,000 servers. Most of the well-known e-commerce sites (e.g. Amazon, Buy.com), auction sites (e.g., eBay), on-line banking (e.g., Citibank, Chase), stock trading (e.g., Schwab), and even government (e.g., irs.gov) have adopted the SSL protocol. Communication with these sites is secured by SSL or its variant, TLS, which are used to provide authentication, privacy, and integrity. A key component of the security of SSL/TLS is the cryptographic strength of the underlying algorithms used by the protocol. It is crucial to ensure that servers using the SSL protocol have employed it properly. The adoption rate of SSL 3.0 is very positive.The on-going developments of SSL/TLS really enable them to win the e-commerce market.

References

Free Encyclopedia of Ecommerce n.d., Secure Electronic Transaction (SET), <http://ecommerce.hostip.info/pages/925/Secure-Electronic-Transaction-SET.html>.

Lee HK, Malkin T & Nahum E 2007, 'Cryptographic strength of ssl/tls servers: current and recent practices', Internet Measurement Conference: Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, San Diego, California, USA, pp.83-92, also available as pdf file, <http://www.imconf.net/imc-2007/papers/imc130.pdf>.

Wikipedia 2009, Secure Electronic Transaction, Wikipedia, The free encyclopedia, last modified 1 April 2009, Wikimedia Foundation, Inc., US, viewed 7 June 2009, <http://en.wikipedia.org/wiki/Secure_electronic_transaction>.

Designing for a secure framework

Find out about SET and the use of RSA 128-bit encryption for e-commerce.

SET is a protocol which is used for sending credit card information over the Internet. It consists of three major components as listed below:

• Electronic Wallet - stores the customer's credit card details in an encrypted file on the customer's computer. At the same time, the software associated with SET will produce a public and a private key for processing.
• SET Server - attaches the digitial signature to the encrypted credit card details received from customers and then, send them to the payment server located at the bank or credit card company.
• Payment Server - validates the credit card details received from the SET server located at the vendor and then, sends a receipt to both the vendor and the customer.

The beauty of SET is to protect the customer's credit card details and the transcation details from being disclosed to the people handling the transactions (Ince 2004, pp. 319-320).

RSA is the most well-known public key cryptograpy system, which was developed by three professors: Ronald Rivest, Adi Shamir and Leonard Adelman at MIT. RSA128-bit encryption is an algorithm that uses a system of public and private keys to encrypt and decrypt messages over an insecure line (Ince 2004, p. 314). Normally, 128-bit is refering to a symmetric key size which is equivalent to a RSA 3072-bit asymmetric key size, in terms of the level of security (Kaliski 2003). Certainly, the longer the key size means the harder to be broken. Kirk (2007) claims that 'the strength of the encryption used now to protect banking and e-commerce transactions on many Web sites may not be effective in as few as five years, a cryptography expert has warned after completing a new distributing-computing achievement'. Kaliski (2003) also points out that RSA1024-bit will be able to protect the security of data until 2010. By that time, the distributed computation capacity will be to break the encryption.

Both SET and RSA encryption can secure the data exchanged in the Internet, which is extremely important in e-commerce transactions.

What can you find out about network and host-based intrusion detection systems?

A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic (Wikipedia 2009).

A host-based intrusion detection system (HIDS) consists of an agent on a host which identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability/acl databases) and other host activities and state (Wikipedia 2009).

What is 'phishing'?

Webopedia (2009) gives the following definition of 'phishing'?

The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information.

As mentioned above, very often phishing scams rely on placing links in e-mail messages, on Web sites, or in instant messages that seem to come from a service that you trust, like your bank, credit card company, or social networking site. We can identify 'phishing' scams or fake websites by carefully examining the suspicious website addresses:

1. any typos on the address,
2. whether the address is a masked address, and
3. whethere extended validation SSL certificate is applied

This will alert us to the phishing scams or fake sites.

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp 295-320.

Kaliski, B 2003, TWIRL and RSA Key Size, RSA Laboratories, 6 May, RSA Security, viewed 6 June 2009, <http://www.rsa.com/rsalabs/node.asp?id=2004>.

Kirk, J 2007, Researcher: RSA 1024-bit Encryption not Enough, PCWorld, 24 May, viewed 6 June 2009, <http://www.pcworld.com/article/132184/researcher_rsa_1024bit_encryption_not_enough.html>.

Wikipedia 2009, Intrusion Detection System, Wikipedia, The free encyclopedia, last modified 3 June 2009, Wikimedia Foundation, Inc., US, viewed 7 June 2009,
<http://en.wikipedia.org/wiki/Intrusion_detection_system>.

Webopedia 2009, phishing, last updated 1 May 2009, <http://www.webopedia.com/TERM/p/phishing.html>.

WK7:End of the line

What are the hosting solutions?

There are many web hosting solutions in the market. The hosting services allows individuals and organizations to provide their own website accessible via the World Wide Web. In the context of the Rail application, OTBS, we can start with a simple a hosting solution at the development stage. Later, when we move to the production stage, a complex hosting solution for a more comprehensive package that provides database support and application development platforms, is required. According to Wikipedia (2009), the following hosting solutions can be considered for OTBS.

Shared web hosting (development stage) - one's Web site is placed on the same server as many other sites, ranging from a few to hundreds or thousands. Typically, all domains may share a common pool of server resources, such as RAM and the CPU. This solution will be more cost-effective as we can run a few projects one server.

Virtual Dedicated Server (production stage) - It divides server resources into virtual servers, where resources can be allocated in a way that does not directly reflect the underlying hardware. This solution will be more cost-effective as we can run a few projects one server.

Dedicated hosting service - The user gets his or her own Web server and gains full control over it. The user has full administrative access to the box, which means the client is responsible for the security and maintenance of his own dedicated box.

Managed hosting service - the user gets his or her own Web server but is not allowed full control over it. The user is disallowed full control so that the provider can guarantee quality of service by not allowing the user to modify the server or potentially create configuration problems. (Engine Yard provides this service, managed ralis hosting.)

Will our Rails applications run on a cloud computing service in future?

Cloud computing is a new type of hosting platform that allows customers powerful, scalable and reliable hosting based on clustered load-balanced servers and utility billing. Removing single-point of failures and allowing customers to pay for only what they use versus what they could use Wikipedia (2009). Without doubt, OTBS will be moved to the cloud computing service one day as this is the trend for web applications. The internet will be the platform on which the web application run.

Can we make a deployment and maintenance plan by team consensus?

According to Hartl & Prochazka (2007), I work out the following deployment and maintenance plan for OTBS.

Software/Hardware option - Use Mongrel as the OTBS appliaction server and deploy to some flavour of Linux. This is recommended to run Apache in front of a single Mongrel if taking dedicated hosting solution.

Run OTBS in production mode - Deployed OTBS needs to be run in the production environment. The purpose of this section is to practice the steps need to deploy OTBS.

Configure Production Server - Install the same software on the production server that we have running on the development machine and configure them accordingly.

Scaling - Use caching to off load the the production server. Rails has a powerful caching system to help avoid the computational and database access expense of generating dynamic HTML.

Version Control - Capistrano is vey good version control system which can automate deployment and roll back of application source code. It optimises single-server or multiserver deployments.

Debugging - Use production.log to debug OTBS, the entire application.


References



Hartl, M. & Prochazka, A. 2007, Railspace, Building a social networking site with Ruby on Rails. Addison Wesley Professional, pp.505-516.



Wikipedia 2009, web hosting service, last updated 17 June, Wikimedia Foundation Inc., US, viewed 22 June 2009, <http://en.wikipedia.org/wiki/Web_hosting_service>.

WK6:Enjoying the Ride

Are we certain that Ruby on Rails is the right platform for Web development?

Ruby on Rails (ROR) is a good choice for the development of OTBS in terms of the cost, flexibility and scalability. ROR is an open source web application framework for the Ruby programming language. In the market, ROR is getting more popular and is welcomed by developers. We can find many plugins and programs on the Internet. Apart from that, the Agile development methodology can enable us to build the scaffolding of OTBS and put it on production within a short time. Later, we can enhance it or add a new module subject to the business needs.

.Net and Java are the most common programming frameworks in the market. Both can be considered to develop OTBS.

Microsoft .NET’s Common Language Runtime (CLR) and Java’s Java Virtual Machine (JVM) are the most popular web application development frameworks. Without installing either one on your computer, many web applications will be able to run on your computer.

The .NET framework's Common Language Runtime (CLR) is much similar to Java Virtual Machine (JVM), in terms of garbage collection, security, just in time compilation (JIT).

Java platform views the Internet world as one language running on different operating systems (OS), whereas .NET framework views the world running on one OS with a programmers having choice of multiple languages. Therefore Java platform interpolates multiple operating systems, and .NET framework interpolates multiple languages. Therefore, SUN Java does not focus on the GUI development as we know the server side programming does not really need GUI. On the contrary, Microsoft dominates the client side desktop market.

So far Microsoft has issued three development tools including C#, VB.NET and C++, including for developments plus five execution containers hosting this runtime, namely: ASP.NET, Windows Shell, VBA scripting host for Office suite, Visual Forms container and IE (Internet Explorer). Much like Java it contains a rich set of API and lib.

Besides, Microsoft has done an excellent job to standardise .Net framework CLI/CLR in European Computer Manufacturing Association (ECMA) and standardise Simple Oject Access protocol (SOAP) through W3C. These will help to take hold the web application development market.

Reference

Banerjee A 2001, .NET framework comparison with Java Architecture, Mindcracker Network, viewed 26 April 2009, <http://www.c-sharpcorner.com/UploadFile/abanerjee/DotNetforJava11292005023419AM/DotNetforJava.aspx>.

WK5:Admiring the scenery

Part A: Survey of mobile device capability and Web 2.0 tools

What is Web 2.0?

First of all, we need to have an idea of what Web 2.0 is about. It has been a very hot topic in the Internet world. At this stage, Web 2.0 is still very cloudy and many people (including researchers, developers and users) are having different interpretations on it. I have actually read through a few comtemporary research arcticles and can only give a very general summary based on the majority views.

Without doubt, Web 2.0 encourages interaction and collaborative work through the Internet no matter you are a developer or an user. Nowadays, many popular websites such as FaceBook, Google Maps and My Space are operating according to this concept (O'Reilly 2005). Social networking is one of the outcomes of Web 2.0. From the perspective of developers, web becomes the development platform by which applications the services are delivered (Pilgrim 2008).

Wigand, Benjamin & Birkland (2008) claims that '...Web 2.0 is a paradigm shift how users use the web, a development that questions everything that has been developed and applied so far. Pilgrim (2008) also agrees with the shift in the paradigm of users' behaviour. In addition, he criticises that the rush to embrace Web 2.0 has resulted in many developers overlooking principles of good design and usability established over the last decade. This is an imperative issue for designing OTBS with the concept of web 2.0 but shouldn't go beyond the pre-defined scope.

1.Find out and recommend what type of mobile devices are suitable for:Just the SMS message service;

a.Just the SMS message service;

I have reviewed a few taxi-booking systems in the major cities such as Perth, Ho Chi Minh City, Sinagaporeb and etc. This is practical and economically and technically feasiable to use the SMS message service the OTBS. In the market, there are many taxi booking systems are available and they employs SMS as one of the communication means between the passengers and the service centre.

b.The full user experience via SMS, GPS Taxi tracking and Google Maps

In Ho Chi Minh City, the taxi booking system, DiaDiem integrates the global positioning system (GPS) and touch screen devices inside a vehicle with the ability to communicate with a mobile phone or website. It focuses on three different perspectives: the customer, call center and taxi.The customer will first use a website, a mobile application or an SMS message to place a taxi pickup order. The website will be launched by DiaDiem later. The order placing process is conducted with the support of a DiaDiem software via a transmission medium (SMS, GPRS or Wi-Fi)( TN 2009).

2.Describe any new hardware, networking, software, systems, procedures and personnel that would be needed by the taxi company Website to support this stage 2 development.

Hardware: touch screen devices with GPS in each taxi, Cell phone or wireless devices with GPRS or 3G that can browse Google map

Software: OTBS backend server and WebSMS software used by the service centre; and Google map used by both passengers and drivers

Networking and system: SMS system including WebSMS, GPS system for GPS tracking

Implementation/Training: cost incured on the implementation and training

Part B: The enhanced customer experience through Web 2.0 technology

1.Use a table to describe how the customer experience is improved by:
a.Horizontal scalability (eg ordering a taxi by mobile phone call or SMS, mobile Internet, desktop or laptop computer)
b.Service oriented features (eg SMS updates using location data, knowing the driver’s name before the ride and being greeted by your name etc)
c.Other customer services enabled by Web 2.0 (eg reputation system)

Part C: Online Taxi Business Process Modelling

Apart from the business basics of offering a clean car, safe driving, being on time, consider the business processes involved and construct a Simple Online Taxi business process model using any suitable drawing tool.

References

O'Reilly, T 2005, What Is Web 2.0:Design Patterns and Business Models for the Next Generation of Software, O'Reilly Media, Inc, viewed 27 May 2009,
<http://www.oreillynet.com/pub/a/oreilly/tim/news/2005/09/30/what-is-web-20.html>.

Pilgrim, JC 2008, 'Improving the usability of web 2.0 applications', Conference on Hypertext and Hypermedia:Proceedings of the nineteenth ACM conference on Hypertext and hypermedia, Pittsburgh, PA, USA, pp. 239-240, <http://delivery.acm.org/10.1145/1380000/1379144/p239-pilgrim.pdf?key1=1379144&key2=9831173421&coll=GUIDE&dl=GUIDE&CFID=38231369&CFTOKEN=10579826>.

TN 2009, First GPS Integrated Taxi booking system to debut, Vietnam Business Finance, posted 27 April, viewed 6 June 2009, <http://www.vnbusinessnews.com/2009/04/first-gps-integrated-taxi-booking.html>.

Wigand, TR, Benjamin, IR & Birkland, LHJ 2008, 'Web 2.0 and beyond: implications for electronic commerce', ACM International Conference Proceeding Series: Proceedings of the 10th international conference on Electronic commerce, Innsbruck, Austria, vol 342, article 7, also available in pdf format, <http://delivery.acm.org/10.1145/1410000/1409550/a7-wigand.pdf?key1=1409550&key2=9823863421&coll=GUIDE&dl=GUIDE&CFID=38172456&CFTOKEN=67009489>.
Zajicek, M 2007, 'Web 2.0: Hype or Happiness?', ACM International Conference Proceeding Series:Proceedings of the 2007 international cross-disciplinary conference on Web accessibility (W4A), Banff, Canada, vol 225 pp. 35-39, <http://www.w4a.info/2007/prog/k2-zajicek.pdf>.