Exercise 12

Exercise 12- Designing for a secure framework
Part 1: Find out about SET and the use of RSA 128-bit encryption for e-commerce.
SET (Secure Electronic Transfer): A protocol designed to en sure the security and integrity of online communications and purchases, Secure Electronic Transaction (SET) uses digital certificates, issued to merchants and other businesses and customers, to perform a series of security checks verifying that the identity of a customer or sender of information is valid.
The SET (Secure Electronic Transaction) protocol is an open industry standard developed for the secure transmission of payment information over the Internet and other electronic networks. SET has the strong support of two major league credit card companies: Visa and MasterCard .SET provides the basic framework within which many of the various components of securing digital transactions function. Digital certificates, digital signatures, and digital wallets all function according to the SET protocol.

Read more:http://ecommerce.hostip.info/pages/925/Secure-Electronic-Transaction-SET.html#ixzz0GCq4VUWr&B

RSA-128 bit Encryption:
Security has also been a major issue in the E-commerce. The strength of an encryption algorithm is based on its key length, expressed in bits. The longer the key length, the harder it is for an attacker to break the cipher. RSA 128-bit encryption is a public-key encryption and authentication system developed in 1977 by Ron Rivest, AdiShamir, and Leonard Aldeman. The method uses modular exponentiation, which can be performed efficiently by a computer, even when the module and exponent are hundreds of digits long. The public key is a modulus m and an exponent e. A message is represented by a number c between 0 and m-1. (If the message is longer, chop it up into pieces and encrypt each piece.) Raise c to the e power mod m and transmit the result. The private key is the same modulus m and the inverse exponent d, such that e×d is 1 mod φ(m). As you recall from the previous page, c to the e to the d gives c back again. Rising to the e encrypts, and raising to the d decrypts. In a typical application, m is the product of two large primes’ p and q. Thus φ(m) = (p-1)×(q-1). Given an exponent e, find the modular inverse relative to φ(m), and call it d. This builds the public and private keys. The security lies in the difficulty of factoring m into its primes. Without p and q, Charlie cannot derive φ(m), and cannot compute d. Anybody can send encrypted data to Bob, but only Bob can decrypt. (anynomous)



Part 2: What can you find out about network and host-based intrusion detection systems?

The goal of intrusion detection is to monitor network assets to detect anomalous behavior and misuse. This concept has been around for nearly twenty years but only recently has it seen a dramatic rise in popularity and incorporation into the overall information security infrastructure.

Network Intrusion system: Network intrusion detection deals with information passing on the wire between hosts. Typically referred to as "packet-sniffers," network intrusion detection devices intercept packets traveling along various communication mediums and protocols, usually TCP/IP. (Innella, 2001)

Host based Intrusion System: Host-based intrusion detection systems are designed to monitor, detect, and respond to user and system activity and attacks on a given host. Some more robust tools also offer audit policy management and centralization, supply data forensics, statistical analysis and evidentiary support, and in certain instances provide some measure of access control. Host-based intrusion detection is best suited to combat internal threats because of its ability to monitor and respond to specific user actions and file accesses on the host. (Power, 1999: 32.)


Part 3: What is 'phishing'?
Phishing is an e-mail fraud method in which the perpetrator sends out legitimate-looking email in an attempt to gather personal and financial information from recipients. A phishing expedition, like the fishing expedition it's named for, is a speculative venture: the phishes puts the lure hoping to fool at least a few of the prey that encounter the bait. (anynomous, Phishing, 2008)

The following link is a YouTube video which decide the Phishing http://www.youtube.com/watch?v=sqRZGhiHGxg