CH 7: E-Commerce: Applications and Issues

E-Commerce (EC): describes the process of buying, selling, transferring or exchanging of products, services or information via computer networks, including the Internet.

E-business: is a broader definition of EC, including

 buying and selling of goods and services

 servicing customers

 collaborating with partners

 conducting e-learning

 conducting electronic transactions within an organization.

                                                             

Pure versus Partial EC depends on the degree of digitization involved:

The product can be physical or digital.

The process can be physical or digital.

The delivery agent can be physical or digital

Brick-and-mortar: purely physical organizations

Click-and-mortar: organizations are those that conduct some EC activities, yet their business is primarily done in the physical world 

Pure Play: organizations that are engaged only in EC

Bricks and Mortar, Partial EC, and Pure EC

                                 

Types of E-Commerce

Business-to-Consumer (B2C): the sellers are organizations and the buyers are individuals

Business-to-Business (B2B): both the sellers and buyers are business organizations

Consumer-to-Consumer (C2C): both the sellers and buyers are individuals 

Business-to-Employee (B2E): An organization uses e-commerce internally to provide                                                                    information and services to its employees.

E-Government (E-Gov.): the use of Internet technology to deliver information about public                                                        services to citizens (Government-to-Citizen [G2C]), business                                                            partners and suppliers (called government-to-business [G2B]) and                                                     between governments [G2G].

Mobile Commerce (m-commerce): e-commerce that is conducted using a mobile phone

E-Commerce Business Models 

Online Direct Marketing: manufacturers sell directly to

                                             customers

Electronic Tendering System: businesses (or governments) request quotation from suppliers                                                 [uses B2B or G2B]   

E-auction – an auction which is held over the Internet

Name-your-own-price: customers decide how much they want to pay  

Find-the-best-price: customers specify a need and an intermediary compares providers                                    and shows the lowest price

                              Different Types of E Commerce Business Models 

Affiliate marketing: Vendors ask partners to place logos or banners on                                           partner’s site. If customers click on logo, go to the vendor’s                            site, and buy, then the vendor pays commission to partners.

Viral marketing: receivers send information about your product to their                              friends.

 Group purchasing: small buyers aggregate demand to get a large                                        volume discount [E-Coops]

Product customization: customers use the Internet to self-configure                            products or services. Sellers then price them and fulfill                               them quickly.

Benefits of E-Commerce   

Benefits to organizations

Makes national and international markets more accessible

Lowering costs of processing, distributing, and retrieving information

Benefits to customer

Access a vast number of products and services around the clock (24/7/365)

Benefits to SocietyAbility to easily and conveniently deliver information, services and products to people in cities, rural areas and developing countries

     

Limitations of E-Commerce

Technological Limitations

Lack of universally accepted security standards

Insufficient telecommunications bandwidth

Expensive accessibility

Non-technological Limitations

Perception that EC is unsecure

Unresolved legal issues

Lacks a critical mass of sellers and buyers

http://ecomputernotes.com/e-commerce/e-commerce/what-are-the-limitations-of-e-commerce

Business-to-Consumer B2C

Electronic retailing (E-tailing): the direct sale of products and services through                                              the Internet

E-marketplace: a central, virtual market space on the Web where many buyers                      and sellers can conduct E-commerce and E-Business activities

E-storefront: a Web site that represent a single store

E-mall/ Cybermall: a collection of individual shops under one 

                                                      

Online Service Industries

Cyberbanking: involves conducting banking activities from home, a place of business or                           on the road instead of at a physical bank location.

E-Bank / virtual Bank/ Cyber Bank: a bank that is dedicated only to Internet                                                                       transactions

Online job market

The internet offers promising new environment for job seekers and for companies searching for hard-to-find employees.

Travel services

The internet is an ideal place to plan, explore and arrange almost any trip economically 

Issues in E-Tailing

Channel conflict: occurs when manufacturers disintermediate their channel partners such as distributors, retailers, dealers, and sales representatives, by selling their products directly to consumers, usually over the Internet through e-commerce

Multichanneling: is a process in which a company integrates its offline and online                                channels.

Order fulfillment: finding the product to be shipped; packaging the product; arrange for                                speedy delivery to the customer; and handle the return of unwanted or                                 defective products.

                               

 Online Advertising

Advertising : an attempt to disseminate information in order to influence a buyer-seller transaction.

Online Advertising methods

Banner: simply electronic billboard 

Pop-up ad : appears in front of the current browser window.

Pop-under ad: appears underneath the active window.

Permission marketing: asks consumers to give their permission to voluntarily accept                                     online advertising and e-mail.

Viral marketing: refers to online “word-of-mouth” marketing

                        

Business-to-Business (B2B)

In B2B e-commerce, the buyers and sellers are organizations

There are several business models for B2B applications:

B2B Sell-Side Marketplace

B2B Buy-Side Marketplace

Electronic Exchanges

Electronic Exchanges

Electronic Exchanges

Vertical Exchanges: connects buyers and sellers in a given industry

Horizontal Exchanges: connects buyers and sellers across many industries, and are used mainly for MRO materials

Functional Exchanges: needed services

such as temporary help or extra office

space are traded on an “as-needed” basis

Electronic Payments

Purchasing card: is the B2B equivalent of electronic credit cards and is typically used for unplanned B2B purchases

                                                    

CH 4: Information Security

 Information Security

 the practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (e.g. electronic, physical)

                          

                                                      

Threat: any danger to which a system may be exposed

Exposure: the harm, loss or damage that can result if a threat compromises that resource

Vulnerability: the possibility that the system will suffer harm by a threat

Introduction to Information Security

Today’s interconnected, interdependent, wirelessly-networked business environment

untrusted network: any network external to your organization

Cybercrime: illegal activities conducted over computer networks , particularly the Internet 

                                           https://www.sans.org/information-security/

Unintentional Threats to Information    Systems

There are intentional and unintentional threats. Unintentional threats are considered to be human error, environmental hazards, and computer failures. Most people don't purposely cause harm. Intentional threats refer to purposeful actions resulting in the theft or damage of computer resources, equipment, and data. Intentional threats include viruses, denial of service attacks, theft of data, sabotage, and destruction of computer resources. Most intentional threats are viewed as computer crimes when executed.

Human Errors

Carelessness with laptops and portable computing devices

Opening questionable e-mails

Careless Internet surfing

Poor password selection

Social Engineering

 in the context of information security, refers to psychological manipulation of 

people into performing actions or divulging confidential information. A type 

of confidence trick for the purpose of information gathering, fraud, or system 

access, it differs from a traditional "con" in that it is often one of many steps in a 

more complex fraud scheme.

                                     

Tailgating: it occurs when an unauthorized person slips in through a door before                 it closes

Shoulder surfing: it occurs when the attacker watches another person’s

                            computer screen over that person’s shoulder

Deliberate Threats to Information Systems

Espionage or trespass: occurs when an unauthorized individual attempts to gain                                                    illegal access to organizational information 

Information extortion: occurs when an attacker either threatens to steal or                                                              actually steals information from a company

Sabotage or vandalism: defacing an organization's website

Theft of equipment or information

Pod slurping: perpetrator plugs portable device into a USB port in a                                              computer and downloads sensitive information

Dumpster diving: rummaging through commercial or residential trash to                                         find information that has been discarded

  Identity theft : assumption of another person’s identity, usually to gain access to                                      their financial information or to frame them for a crime

                  
   

Deliberate Threats to Information System

Compromises to Intellectual Property (IP)

Intellectual property (IP) is a legal term that refers to creations of the mind. Examples of intellectual property include music, literature, and other artistic works; discoveries and inventions; and words, phrases, symbols, and designs. Under intellectual property laws, owners of intellectual property are granted certain exclusive rights.

Trade secret: an intellectual work such as business plan, that is a company secret and not based on public information

Patent: a document that grants the holder exclusive rights on an                                           invention or process for 20 years.                        

Copyright: a statuary grant that provides the creator of IP with                                                      ownership of the property for  the life of the creator plus 70 years

Piracy: the illegal copying of software

                                    

Software attacks

Virus: a segment of computer code that performs malicious actions by attaching to another computer program.

Worm: a segment of computer code that spreads by itself and performs malicious                       actions without requiring another computer program

Trojan horse: a software program that hides in other computer programs and reveal                             its designed behavior only when it is activated.  A typical behavior of a                             Trojan horse is to capture your sensitive information (e.g., passwords,                             account numbers, etc.) and send them to the creator of the Trojan                                     horse.
Logic Bomb: a segment of computer code that is embedded within an                                                         organization’s existing computer programs and is designed to                                               activate and perform a destructive action at a certain time and date

Phishing attacks

use deception to acquire sensitive personal information by masquerading as official-looking e-mail

Denial-of-service attack

Attackers sends so many information requests to a target computer system that the system cannot handle them successfully, and typically crashes  

             

Alien Software

Alien is a computer program that converts between different Linux package formats, written by Joey Hess.

Keystroke loggers: record your keystrokes and your Web browsing history

Screen scrapers: record a continuous “movie” of what you do on a screen

Spamware: alien software that is designed to use your computer as a launchpad for spammers.  Spam is unsolicited  (unwanted)  e-mail

Cybercrime

is any crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target.

Supervisory Control and Data Acquisition (SCADA) Attacks 

                                     

What Organizations Are Doing to Protect Information Resources

Risk: the probability that a threat will impact an information resource

Risk management: to identify, control and minimize the impact of threats.

Risk analysis: to assess the value of each asset being protected, estimate the probability it might be compromised, and compare the probable costs of it being compromised with the cost of protecting it.

Risk mitigation: is when the organization takes concrete actions against risk. It has                                   two functions:

*implement controls to prevent identified threats from occurring

* develop a means of recovery should the threat become a reality

Risk Acceptance: accept the potential risk, continue operating with no controls, and                                      absorb any damages that occur.

Risk limitation: Limit the risk by implementing controls that minimize the impact of                                 threat.

Risk transference: Transfer the risk by using other means to compensate for the loss,                                        such as purchasing insurance and having off-site backups  

                                               

Information Security Controls

re safeguards or countermeasures to avoid, counteract or minimize security risks relating to personal property, or any company property. For business-to-business facing companies whose service may affect the financial statements of the other company, the prospect may require successful audit reports of policy controls such as a SSAE 16 report before granting them authorization as a vendor.

Physical controls: physical protection of computer facilities and resources (Guards,                              doors, alarm systems)

Access controls: restriction of unauthorized user access to computer resources

Communications (network) controls: protect the movement of data across networks                                                                      and include border security controls,                                                                                           authentication and authorization.

Application controls: protect specific applications

Access Controls

Determines/confirms the identity of the person requiring access

Something the user is: access controls that examine a user's physiological or behavioral characteristics

Biometrics

Voice verification

Fingerprints

Retina scan

Something the user has : these access controls include regular ID cards, smart                                                cards

Something the user does : these access controls include voice and signature                                                      recognition

Something the user knows

Password : a private combination of characters that only the user                                  should know

  example: nam3-beeS

Passphrases: a series of characters that is longer than a password but                                        can be memorized easily

example: omanFT2brazilworldcup

Access Controls

Authorization

Determines which actions, rights or privileges the person has to do certain activities with information resources, based on his/her verified identity

Privilege: a collection of related computer system operations that can be                                performed by users of the system

Least privilege: a principle that users be granted the privilege for some activity                            only if there is a justifiable need to grant this authorization

CAPTCHA

an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart") is a type ofchallenge-response test used in computing to determine whether or not the user is human

                                             

Communication / Network Controls

Firewall : is a network security system that controls the incoming and outgoing network traffic based on an applied rule set. A firewall establishes a barrier between a trusted, secure internal network and another network (e.g., the Internet) that is assumed not to be secure and trusted


                                     

Anti-malware systems: software packages that attempt to identify and eliminate viruses, worms, and other malicious software

                                       

Whitelisting: a process in which a company identifies the software that it will allow to                             run and does not try to recognize malware

Blacklisting: a process in which a company allows all software to run unless it is on                                    the blacklist

Intrusion detection systems: designed to detect all types of malicious network traffic                                              and computer usage that cannot be detected by a firewall 

Encryption: Process of converting an original message into a form that cannot                            be read by anyone except the intended receive                                                         

How Digital Certificates Work?

         is an electronic "passport" allowing people, computers or organizations to exchange                secure information over the Internet using the public key infrastructure (PKI).

Certificate authorities: trusted intermediaries between two organizations, issue digital certificates

                                              

Virtual private networking (VPN) : a private network that uses a public network (usually the                                                           Internet) to connect users

Secure Socket Layer now called transport layer security (TLS): is an encryption standard used for secure transactions such as credit card purchases and online banking.

Vulnerability management systems: (also called security on demand) extend the security perimeter that exists for the organization’s managed devices, to unmanaged, remote devices.

Virtual Private Network and Tunneling

Tunneling encrypts each data packet that is sent and places each encrypted packet inside another packet