|
Introduction |
AppShield Will Secure Your Site Against These And Many Other
Kinds of "Hack Attack" Tactics
(roll over each "Hack Attack" for a description)
|
Providing security for eBusiness is a highly dynamic problem. The rapid
evolution of applications and the numerous technologies that enable
eBusiness create an often changing set of requirements for eBusiness
security. Security issues and the technologies used to address them can
be roughly divided into three categories: data transmission and
authentication, network security, and
application security.
|
| Data Transmission & Authentication |
eBusiness requires that sensitive information be transmitted over the
Internet. Unfortunately, as a public network, the Internet is a very
insecure medium for transmitting sensitive data.
Each individual eBusiness transaction is comprised of many data packets.
A data packet sent from one point to another must pass through numerous
intermediate points (nodes) before reaching its destination, and each of
the many packets comprising a single transaction may take a different
route. At every one of the intermediate nodes through which they pass,
packets are vulnerable to interception by hackers.
This problem is typically solved using technologies such as
Secure Socket Layer (SSL)
and
Virtual Private Networking (VPN)
to encrypt data and create
a secure channel of communication between interacting parties.
Encryption keys are negotiated in a secure manner using
Public Key Infrastructure (PKI),
which allows any two peers using compatible products to establish their
own private, secure channel.
In many cases, a higher level of assurance regarding the specific
identity of the parties must complement data encryption. There are
several common mechanisms to establish this assurance, including user
names and passwords, digital certificates, PKI, smartcards, biometrics,
and other authentication devices. Each measure requires a tradeoff
between the level of assurance -- user name and password being the
lowest -- and the deployment complexity -- which reaches its maximum
with biometrics and authentication devices.
|
| Network Security |
|
Delivering data with seamless connectivity between any two
points on the Internet requires a great deal of underlying
networking logic. This logic is provided by the Internet
Protocol (IP), and overlying protocols such as TCP, UDP, ICMP,
etc. These protocols define everything from the addressing
scheme to routing information and control directives. The
complexity of these data transmissions provides fertile ground
for hackers searching for loopholes. Any computer connected to
the Internet is potentially vulnerable to a wide range of
attacks aimed at exposing weaknesses in the computer�s network
interface and configuration. Such attacks can expose the
computer�s internal resources to misuse, theft or destruction.
The solution to these threats comes in the form of
firewalls
and
intrusion detection
tools.
Firewalls use built-in --network knowledge-- to block network-level openings,
leaving only required pathways open. For example, an
organization may use a firewall to block all incoming traffic
except for email, and all outgoing traffic, except for email,
telnet and web browsing. Intrusion detection tools
are applications or devices designed to identify network-level
attack patterns, react to them, and notify system operators.
Firewalls and intrusion detection tools provide robust security
against hacker attacks that seek to take advantage of the
complexity of network connectivity.
|
| Application Security |
|
Application security
is one of the most challenging aspects of eBusiness security. Put simply, application-level security ensures that eBusiness applications interact with end users only in ways that were intended by the application�s developers. Application-level security is focused on preventing the unauthorized use of an eBusiness� resources or customer information by hackers attempting to gain access to the eBusiness network directly through the application itself. Application-level hacks typically exploit weaknesses in HTML coding, Common Gateway Interfaces
(CGIs), or in third party products such as web servers or scripts. The following pages will more fully describe the problem of application security and a general approach to solving the problem.
|