Exercise 9

1. Find out about SET and the use of RSA 128-bit encryption of e-commerce.

In the Internet arena, the growth of e-commerce is not much quickly as the Internet growth itself. It is largely hindered by the security threat. Many security protection mechanisms have been developed.

The SET (Secure Electronic Transaction) is an ‘open encryption and security specification designed to protect credit card transactions on the Internet.’ (Stalling, 2002) The initial version, SETv1, was emerged from a call for security standards by MasterCard and Visa in February 1996. Later more companies jointed the development of the specification, like IBM, Microsoft, Netscape, RSA, Terisa, and Verisign.

After years of evolution, SET is now widely used for secured digital transactions. The digital certificates, digital signatures, and digital wallets all function according to the SET protocol. (Free Encyclopedia of Ecommerce, n.d.)

There are several components for the SET protocol.

• The Cardholder Application, also referred to as a digital wallet, is held by an online consumer and packages a digital signature and credit card information that ensures his or her identity and safeguards his or her financial information through a complex encryption system.
• The Merchant Server component is the verification product held by the merchant to process the online card payment.
• The Payment Gateway component is held by an acquiring bank or other trusted third party that accepts and processes the merchant's verification and the customer's payment information and filters them to their appropriate financial institutions.
• The Certificate Authority component, usually run by a financial institution, is the trusted agent that issues the digital certificates and is responsible for ensuring that all users of digital certificates are in fact secure and trustworthy customers.

As the SET is more on the security mechanism side, the RSA is a cryptography algorithm. The name RSA actually named after the three inventor called Rivest, Shamir and Adleman, where they were the first to invent this algorithm for public-key cryptography. From Wiki, It is the ‘first algorithm known to be suitable for signing as well as encryption, and was one of the first great advances in public key cryptography. RSA is widely used in electronic commerce protocols, and is believed to be secure given sufficiently long keys and the use of up-to-date implementations.’ (Wiki, 2010)

In the cryptography, the key size or key length makes a difference on the security level. The 128 bits key size follows the standard AES (Advanced Encryption Standard) that published in 2001. Optional It also can use keys up to 256 bits (a specification requirement for submissions to the AES contest). 128 bits is currently thought, by many observers, to be sufficient for the foreseeable future for symmetric algorithms of AES's quality. The U.S. Government requires 192 or 256-bit AES keys for highly sensitive data.

References

Free Encyclopedia of Ecommerce. (n.d.) Secure Electronic Transaction. Retrieved on 11 May 2010 from http://ecommerce.hostip.info/pages/925/Secure-Electronic-Transaction-SET.html#ixzz0naiBdjeg

Stallings, W. (2002). Introduction to Secure Electronic Transaction (SET), Prentice Hall. Retrieved on 11 May 11, 2010 from http://www.informit.com/articles/article.aspx?p=26857

Wiki. (2010). Key size. Retrieved on 11 May 2010 from http://en.wikipedia.org/wiki/Key_size

2. What can you find out about network and host-based intrusion detection systems?

Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. An IDS (Intrusion detection system) is a device (or application) that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station.

There are two main types of IDS's: network-based and host-based IDS.

In a network-based intrusion-detection system (NIDS), the sensors are located at choke points in the network to be monitored, often in the demilitarized zone (DMZ) or at network borders. The sensor captures all network traffic and analyzes the content of individual packets for malicious traffic.

In a host-based system, the sensor usually consists of a software agent, which monitors all activity of the host on which it is installed, including file system, logs and the kernel. Some application-based IDS are also part of this category.

Wiki. (2010). Intrusion detection system. Retrieved on 11 May 2010 from

http://en.wikipedia.org/wiki/Intrusion_detection_system

3. What is 'phishing'?

Phishing basically is the online identity theft. It usually appears in the form of email of your friend or a trustworthy web site, and links to a web site to input the personal information like user name and password, credit card information.

4. What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?

While the SET uses a mechanism to avoid the merchants get the credit card detail information, the SSL (Secure Sockets Layer) is a encrypted client/server protocols to enable safe communication between network devices.

The SSL was developed by Netscape, as a encryption standard for the data between a Web browser and a Web server. ‘The version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996’ (Rescorla 2001).T

SSL is supported and built into all major browsers and web servers nowadays; it is easily used to install a digital certificate on the machine The encryption level also depends on the key size, with 40 and 128-bit, which the 128-bit key is deemed to be strongly secured for foreseeable future.

As supported by the major browsers and easy to use, the SSL is vastly used in the outlet shops. The SET might be more secure because of the double checking mechanism but it asks for higher cost and complexity, and mainly supported by the Visa and Master Card, therefore it is less popular.

References

Wiki. (2010). SSL. Retrieved on 12 May 2010 from http://en.wikipedia.org/wiki/SSL

5. What are cookies and how are they used to improve security? Can the use of cookies be a security risk?

Cookies are ‘name-value’ pairs to contain user information of the browser. It can store user name, password, site preferences…etc. This information basically are stored in text strings. The cookie is sent from the web server to the browser machine as an HTTP header, then sent back each time it access the server.

The cookies can be improved the security by encrypted the data. However, as it contains the user information, some spywares target the cookie to track the user’s privacy, so it can be a security risk.

References

Wiki. (2010). HTTP Cookies. Retrieved on 12 May 2010 from http://en.wikipedia.org/wiki/HTTP_cookie

6. What makes a firewall a good security investment? Accessing the Internet, find two or three firewall vendors. Do they provide hardware, software or both?

From a research report, a firewall can bring the below benefits as ROI (Computer Economics, n.d.)

The return on investment is calculated based on the following product benefits:

• Increases network availability by stopping the spread of malicious code attacks (i.e., Nimda, Trojan horses, DDoS).
• Protects remote users from attacks.
• Reduces administrative costs and deploys rapidly with ePolicy Orchestrator management capabilities.
• Stops internal hackers from stealing proprietary data from desktops.
• Temporarily or permanently blocks unauthorized, vulnerable, and expensive application connections.

As the hacking technology getting advanced every day, the firewall technologies have to be getting up-to-date as well. The three firewall software below are the top-listed in 2010, from ‘All-Internet-Security.com’ (All-Internet-Security.com, 2010)

#1 ZoneAlarm PRO Firewall 2010

#2 F-Secure Internet Security 2010

#3 Prisma Firewall 2009

References

All-Internet-Security. (2010). Best Firewall Software - Editor's Choice. Retrieved on 12 May 2010 from http://www.all-internet-security.com/top_10_firewall_software.html

Computer Economics. (n.d.). ROI Analysis of McAfee Desktop Firewall

Software and Support. Retrieved on 12 May 2010 from www.crswann.com/.../DesktopFirewall-ROI-Analysis(ComputerEconomics).pdf

7. What measures should e-commerce provide to create trust among their potential customers? What measures can be verified by the customer?

According to the research from Xerox and Research Technology, the e-commerce trust can be measured by the ‘trust metric’. (Manchala, 2000) The measurement can be summarized as below.

• Transacting entity: Any entity that engages itself in an electronic commerce transaction is a transacting entity. This entity could be a customer, a vendor, a broker, an intelligent agent, a payment server, or any intermediary.
• Trust authority: Trust matrices are used to evaluate the trust on a certain transaction or on the next set of transactions. Unless these trust matrices are protected against manipulation and are maintained by certain authorities, transacting entities cannot trust them. These authorities are called trust authorities (TA). Transacting entities use trust protocols to access trust matrices. A TA maintains trust matrices by updating them based on the information received from each completed transaction. TAs should be able to provide proof to trust matrix updates using non repudiation services and to provide each of the transacting entities the level of trust index to be placed on a certain transaction.
• Agreement Framework1: A relationship binding all the transacting entities involved in a single set of transactions. The relationship usually includes various policies for conducting transactions and is usually placed at a TA. Each set of transactions is interpreted based on the policy, and the results are used to update trust matrices.

References

Manchala, D. (2000). E-Commerce Trust Metrics and Models. Xerox Research and Technology. Retrieved on 12 May 2010 from ftp://ftp.tik.ee.ethz.ch/pub/lehre/inteco/SS02/material/00832944.pdf

M. Roscheisen and T. Winograd, “A Communication Agreement Framework of

Access/Action Control,” Proc. IEEE Symp. Security and Privacy, IEEE Computer

Society Press, Los Alamitos, Calif., May 1996, pp. 154-163.

8. Get the latest PGP information from http://en.wikipedia.org/wiki/Pretty_Good_Privacy
The use of digital certificates and passports are just two examples of many tools for validating legitimate users and avoiding consequences such as identity theft. What others exist?

According to Wiki, Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was created by Philip Zimmermann in 1991.

PGP and similar products follow the OpenPGP standard (RFC 4880) for encrypting and decrypting data. The latest version is called PGP5.

Besides the digital certificates and passports, web of trust and security quality are two other tools.

References

Wiki. (2010). PGP. Retrieved on 12 May 12, 2010 from http://en.wikipedia.org/wiki/Pretty_Good_Privacy

Elevator pitch 1

Hello, my name is Leo Lee, I’m an IT infrastructure Consultant.

I’ve selected the role of IT Infrastructure Manager, as the knowledge in this course can be directly applied to the clients that I’ll visit.

My e-portfolio will be around the e-commerce infrastructure, the skills will include:

1. E-commerce, distributed applications and the Internet
2. Clients, servers and distributed paradigms
3. Database servers
4. Programming web servers
5. Web technologies & frameworks
6. Distributed objects
7. Internet security
8. Concurrency and transactions
9. Business process modeling & MVC
10. Bots, agents, spiders and mobile computing
11. Describe about cloud, grid & service oriented computing
12. Systems integration on open source and Microsoft platforms

Hope this explains my e-portfolio clearly. Have a nice day. Bye

Workshop 3

1. Set up the MySQL tools on your computer as described in section 6 above.

The GUI tool is called MySQL Workbench, and is downloaded from http://www.mysql.com/products/tools/. The latest GA version is 5.1.18a. A Microsoft MSI installation file is available. After installation, it is running successfully and the screen shot is as follow.




2. Rails will setup a new application directory for each of your Web application projects. Get InstantRails (Windows) or Locomotive (MacOS) running on your machine. Both packages install Ruby, Rails, a Web server or one called ‘Mongrel’ or another small Ruby Web server called ‘WEBrick’, and MySQL “inside a bubble” as I call it so that others parts of your system are not modified (Similarly ZOPE does with installing its own Web server and Python versions).

I did not install InstantRails, but the Ruby and Rails from rubyforge.org. The version is 1.86-27, it is an older one but stable.




The RoR is installed successfully, and the folder c:\Ruby is created.

In this version, the RubyGems is not necessary to installed separately. But according to the installation instruction, two instructions to update the RubyGems are required.


C:\rudy> gem update rails

C:\ruby>gem install rails—include-dependencies (takes quite a while)

After installation is completed, the online taxi booking system (OTBS) is created by running command from the Ruby folder.





Associated folders are created.

To start the WEBrick server, below command is run at the c:\ruby\otbs folder.

3. Once Rails is running you at http://localhost:3000, you need to configure database access. Connection to the database is specified in the config/database.yml file.

The port at 3000 of Rails is running as shown as follow:

The detail of the config/database.yml is shown below. The database that connected from three environment ‘development’, ‘test’ and ‘production’ are specified by default.

4. Generate the Passenger model by creating the MySQL database and ‘passengers’ table from the information above.

The procedure can be straightly followed through the Ruby on Rails instructions:

(a) Showing options by running without parameters

(b) Running script/generate command with table ‘Passengers’ and columns

The models and controllers folders are created

(c ) Run rake command to migrate the database

Worshop 4

To do:

1. Spend some time moving your way through the 46 Ruby coding examples in the Ruby Tutorial with Code from http://www.fincher.org/tips/Languages/Ruby/


2. What are the syntax differences in the way that Ruby and Javascript use the if statement?
Below is a simple example comparing the basic syntax.
JavaScript
if (card > 21) {
document.write("busted");
} else if (card == 21) {
document.write("won");
} else {
document.write("continue");
}
Ruby
if card > 21
print "busted"
elseif card == 21
print "won"
else
print "continue"
end


3. While Ruby and Python are quite similar, can you find some similarities between Ruby and Javascript?

The main similarity between Ruby and Javascript is quite fundamental; they both have similar syntax and are object-oriented language.


Challenge Problems:

1. Create, test and debug a Ruby program called dognames.rb or catnames.rb to accept 3 names from the keyboard and to display each name on the screen in alphabetical order WITHOUT using a data structure such as a list.




2. Write a Ruby program called fizzbuzz.rb that prints the numbers from 1 to 100. But for multiples of three print "Fizz" instead of the number and for the multiples of five print "Buzz". For numbers which are multiples of both three and five print "FizzBuzz".





3. Compare the Ruby and Python versions of the dog years calculator:

#!/usr/bin/ruby
# The Dog year calculator program called dogyears.rb

def dogyears
# get the original age
puts “Enter your age (in human years): "
age = gets # gets is a method for input from keyboard
puts # is a method or operator for screen output

#do some range checking, then print result
if age <> 110
puts "Frankly, I don't believe you."
else
puts "That's", age*7, "in dog years."
end
dogyears

Python

#!/usr/bin/python
# The Dog year calculator program called dogyears.py

def dogyears():
# get the original age
age = input("Enter your age (in human years): ")
print # print a blank line

# do some range checking, then print result
if age <> 110:
print "Frankly, I don't believe you."
else:
print "That's", age*7, "in dog years."

### pause for Return key (so window doesn't disappear)
raw_input('press Return>')

def main():
dogyears()
main()

Comparsion:

Ruby Python
File extension rb py
Function quotation No quotation ():
Remark # #
Prompt Puts “ “ Input (“ “)
End of loop 'End' statement No need to put ‘End’ Statement

Exercise 8

Create an XML document for an online catalogue of cars where each car has the child elements of make, model, year, colour, engine, number_of_doors, transmission_type and accessories. The engine has child elements called number_of_cylinders and fuel_system.

Taking reference from W3School.com, below is the scripts.

Exercise 7

1. Why is the perception getting stronger that integration will become a critical factor in coming days?

The perception of integration getting stronger is because it can bring business benefits. The benefits could be extracted from a research from a networking consultancy company called Camden. (Zeichick. A., 2004)The research is called 'THE BUSINESS BENEFITS OF INTEGRATION', and the main points are summarized below.

Integration may be the most cost-effective way for IT to add business value to the enterprise.

Revenue Enhancers
1. Sell more through suggestive sales techniques.
2. Boost customer retention by turning customer service into self-service.
3. Increase revenue by empowering your own sales and support teams.

Cost Reducers
4. Eliminate the cost of storing and managing redundant data.
5. Reduce the cost of manual data reentry and report generation.
6. Lower ongoing system administration expenses.

Efficiency Improvers
7. Accelerate application development using modern RAD platforms.
8. Control and simplify business processes via work flow.
9. Efficiently incorporate modern security programs.

Future Planning
10. Lay an architectural framework that will provide the enterprise with greater agility.

References

Zeichick.A. (2004). The Business Benefits of Integration. Camden Associates. Retrieved on 3 April, 2010 from www.attachmate.com/NR/rdonlyres/...50C0.../literature_bbintegrate.pdf


2. What is the relationship of AJAX to JQuery (jquery.com) and the lightweight Web 2.0 javascript framework called MooTools (mootools.net) within the enterprise software architecture?

The below information are extracted from Wiki.

jQuery is a lightweight cross-browser JavaScript library that emphasizes interaction between JavaScript and HTML. It was released in January 2006 at BarCamp NYC by John Resig. Used by over 27% of the 10,000 most visited websites, jQuery is the most popular JavaScript library in use today. (Wiki, 2010)

MooTools (My Object-Oriented Tools) is an open-source, lightweight, modular object-oriented programming JavaScript Web application framework released under the MIT License. …The framework includes built-in functions for manipulation of CSS, DOM elements, native JavaScript objects, Ajax requests, DOM effects, and more. MooTools also provides a detailed, coherent application programming interface (API)[8], as well as a custom downloads module allowing developers to download only the modules and dependencies they need for a particular app.

References

Wiki. (2010). iQuery. Retrieved on 4 April 2010 from http://en.wikipedia.org/wiki/JQuery
Wiki. (2010). Mootools. Retrieved on 4 April 2010 from http://en.wikipedia.org/wiki/Mootools

4. What does it mean to develop RESTful practices into our web applications?

Representational State Transfer (REST) is a style of software architecture for distributed hypermedia systems such as the World Wide Web. Conforming to the REST constraints is referred to as being ‘RESTful’.

Constraints
The REST architectural style describes the following six constraints applied to the architecture, while leaving the implementation of the individual components free to design:

Client-server
Stateless
Cacheable
Layered system
Code on demand (optional)
Uniform interface

Complying with these constraints, and thus conforming to the REST architectural style, will enable any kind of distributed hypermedia system to have desirable emergent properties, such as performance, scalability, simplicity, modifiability, visibility, portability and reliability.

Impmenting RESTful web services
A RESTful web service (also called a RESTful web API) is a simple web service implemented using HTTP and the principles of REST. It is a collection of resources, with three defined aspects:

• the base URI for the web service, such as http://example.com/resources/
• the MIME type of the data supported by the web service. This is often JSON, XML or YAML but can be any other valid MIME type.
• the set of operations supported by the web service using HTTP methods (e.g., POST, GET, PUT or DELETE).

Unlike SOAP-based web services, there is no "official" standard for RESTful web service.[8] This is because REST is an architecture, unlike SOAP, which is a protocol. Even though REST is not a standard, a RESTful implementation such as the Web can use standards like HTTP, URL, XML, PNG, etc.

Exercise 6

1. Design the form
“Retrofit” the form data string above:

name=Evan+Burke&card=Visa&number=8443261344895544&order=French+perfume

for buying some French perfume into the HTML form fields and submit button on the Web page form.

My scripts are as follow:



The screen shot of running the program is as follow:





2. Write the script
Script archives exist for PERL, Python and JavaScript. Search the Web for a script that processes the HTML forms data. Read the code and list the steps involved in processing the form.

The scripts I found from the web is as follow, and the steps are very self-explanatory.

#!/usr/bin/python

import sys
import time
import cgi

sys.stderr = sys.stdout

# Read in a template for the page we're to generate

fh = open ("template.htp")
html = "".join(fh.readlines())

# Read in the form contents and save them in a dictionary

inputs = cgi.FieldStorage()
fill = {}
for key in inputs:
fill[key] = inputs[key].value

# Do Work!
# Use values in input to create values in fill

matched = lines = 0
fval = fill.get("code","")
if fval != "":
fill["result"] = "Dialling codes starting " + fill["code"]
fhdata = open("../../live_html/data/stdcodes.xyz")
while 1:
line = fhdata.readline();
if line == "": break
if line.startswith(fval):
fill["result"]+= "
" + line
matched += 1
lines += 1
fill["result"] += "
matched "+str(matched)+ \
" out of "+str(lines)
else:
fill["result"] = "Your results will appear here"
fill["time"] = str(time.time());

# Fill in the response template

for key in fill:
lookfor = "%"+key+"%"
html = html.replace(lookfor,fill[key])

# Send out the results

print "Content-type: text/html\n\n",html


3.Can you modify the script to process the form?

Yes, I can but I would not because it is quite simple already.