Tài liệu Hack Proofing E-Commerce Site docx

From the authors
of the best-selling
HACK PROOFING
™
YOUR NETWORK
Your E-commerce Site
™
1 YEAR UPGRADE
BUYER PROTECTION PLAN
Your E-commerce Site
From the authors
of the best-selling
HACK PROOFING
™
YOUR NETWORK
Ryan Russell
Teri Bidwell
Oliver Steudler
Robin Walshaw
L. Brent Huston
Technical Editor
The Only Way to Stop a Hacker Is to Think Like One
• Step-by-Step Instructions for Securing Financial Transactions
and Implementing a Secure E-Commerce Site
• Hundreds of Tools & Traps and Damage & Defense Sidebars
and Security Alerts!
• Complete Coverage of How to Hack Your Own Site
134_ecomm_FC 6/19/01 2:14 PM Page 1

With more than 1,500,000 copies of our MCSE, MCSD, CompTIA, and Cisco
study guides in print, we continue to look for ways we can better serve the

information needs of our readers. One way we do that is by listening.
Readers like yourself have been telling us they want an Internet-based ser-
vice that would extend and enhance the value of our books. Based on
reader feedback and our own strategic plan, we have created a Web site
that we hope will exceed your expectations.
is an interactive treasure trove of useful infor-
mation focusing on our book topics and related technologies. The site
offers the following features:
■
One-year warranty against content obsolescence due to vendor
product upgrades. You can access online updates for any affected
chapters.
■
“Ask the Author”™ customer query forms that enable you to post
questions to our authors and editors.
■
Exclusive monthly mailings in which our experts provide answers to
reader queries and clear explanations of complex material.
■
Regularly updated links to sites specially selected by our editors for
readers desiring additional reliable information on key topics.
Best of all, the book you’re now holding is your key to this amazing site.
Just go to www.syngress.com/solutions, and keep this book handy when
you register to verify your purchase.
Thank you for giving us the opportunity to serve your needs. And be sure
to let us know if there’s anything else we can do to help you get the max-
imum value from your investment. We’re listening.
www.syngress.com/solutions
134_ecomm_FM 6/19/01 11:49 AM Page i
134_ecomm_FM 6/19/01 11:49 AM Page ii

The Only Way to Stop a Hacker is to Think Like One
Your E-commerce Site
™
1 YEAR UPGRADE
BUYER PROTECTION PLAN
Your E-commerce Site
134_ecomm_FM 6/19/01 11:49 AM Page iii
Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production
(collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from
the Work.
There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold
AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other inci-
dental or consequential damages arising out from the Work or its contents. Because some states do not allow
the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not
apply to you.
You should always use reasonable case, including backup and other appropriate precautions, when working
with computers, networks, data, and files.
Syngress Media®, Syngress®, and “Career Advancement Through Skill Enhancement®,”are registered trademarks
of Syngress Media, Inc. “Ask the Author™,”“Ask the Author UPDATE™,”“Mission Critical™,” and “Hack
Proofing™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are
trademarks or service marks of their respective companies.
KEY SERIAL NUMBER
001 AERAF43495
002 VNA49FU4FJ
003 CAKL3956FM
004 BNA424TURT
005 BNTUR495QF
006 596JFA3RRF
007 Y745T9TBLF

008 QW5VCD986H
009 BN3TE5876A
010 NVA384NHS5
PUBLISHED BY
Syngress Publishing, Inc.
800 Hingham Street
Rockland, MA 02370
Hack Proofing Your E-Commerce Site
Copyright © 2001 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America.
Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or dis-
tributed in any form or by any means, or stored in a database or retrieval system, without the prior written
permission of the publisher, with the exception that the program listings may be entered, stored, and executed
in a computer system, but they may not be reproduced for publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN: 1-928994-27-X
Technical edit by: L. Brent Huston Copy edit by: Darren Meiss and Beth A. Roberts
Technical review by: Kevin Ziese Freelance Editorial Manager: Maribeth Corona-Evans
Co-Publisher: Richard Kristof Index by: Robert Saigh
Developmental Editor: Kate Glennon Page Layout and Art by: Shannon Tozier
Acquisitions Editor: Catherine B. Nolan
Distributed by Publishers Group West in the United States.
134_ecomm_FM 6/19/01 11:49 AM Page iv
v
Acknowledgments
v
We would like to acknowledge the following people for their kindness and support
in making this book possible.
Richard Kristof and Duncan Anderson of Global Knowledge, for their generous
access to the IT industry’s best courses, instructors and training facilities.

Ralph Troupe, Rhonda St. John, and the team at Callisma for their invaluable insight
into the challenges of designing, deploying and supporting world-class enterprise
networks.
Karen Cross, Lance Tilford, Meaghan Cunningham, Kim Wylie, Harry Kirchner, Bill
Richter, Kevin Votel, and Brittin Clark of Publishers Group West for sharing their
incredible marketing experience and expertise.
Mary Ging, Caroline Hird, Simon Beale, Caroline Wheeler,Victoria Fuller, Jonathan
Bunkell, and Klaus Beran of Harcourt International for making certain that our
vision remains worldwide in scope.
Anneke Baeten, Annabel Dent, and Laurie Giles of Harcourt Australia for all
their help.
David Buckland,Wendi Wong, Daniel Loh, Marie Chieng, Lucy Chong, Leslie Lim,
Audrey Gan, and Joseph Chan of Transquest Publishers for the enthusiasm with
which they receive our books.
Kwon Sung June at Acorn Publishing for his support.
Ethan Atkin at Cranbury International for his help in expanding the Syngress
program.
Joe Pisco, Helen Moyer, and the great folks at InterCity Press for all their help.
134_ecomm_FM 6/19/01 11:49 AM Page v
134_ecomm_FM 6/19/01 11:49 AM Page vi
vii
Contributors
Ryan Russell
(CCNA, CCNP) is the best-selling author of Hack
Proofing Your Network: Internet Tradecraft (ISBN: 1-928994-15-6). He is MIS
Manager at SecurityFocus.com, has served as an expert witness on secu-
rity topics, and has done internal security investigation for a major soft-
ware vendor. Ryan has been working in the IT field for over 11 years, the
last 6 of which have been spent primarily in information security. He has
been an active participant in various security mailing lists, such as

BugTraq, for years. Ryan has contributed to four Syngress titles on the
topic of networking. He holds a Bachelors of Science degree in
Computer Science. Ryan wishes to thank Karen Mathews at the U.S.
Department of Energy for her assistance in preparing Chapter 10.
Mark S. Merkow
(CCP) has been an Information Systems professional
since 1975, working in a variety of industries. For the last 12 years he has
been working for a Fortune 50 financial services company in Phoenix,
AZ. Mark holds a Masters in Decision and Information Systems from
Arizona State University’s College of Business and is completing his
Masters of Education in Educational Technology at ASU’s College of
Education, specializing in developing distance learning courses.Today he
serves as an e-commerce Security Advisor working with both internal
and external Web designers and developers. Mark has authored or co-
authored six books on computer technology since 1990, including
Breaking Through Technical Jargon, Building SET Applications for Secure
Transactions, Thin Clients Clearly Explained, Virtual Private Networks For
Dummies, A Complete Guide to Internet Security, and The ePrivacy Imperative.
In addition, Mark is a computer columnist for several local, national, and
international print publications, along with an e-zine hosted
at Internet.com.
Robin Walshaw
(MCSE, DPM), author of Mission Critical Windows
2000 Server Administration (ISBN: 1-928994-16-4), is an independent
consultant who architects security and infrastructure solutions for large
134_ecomm_FM 6/19/01 11:49 AM Page vii
viii
corporations around the globe. By applying a combination of sound busi-
ness sense and technical insight, Robin is able to design and deliver scal-
able solutions targeted at enabling the enterprise to effectively leverage

technology.With a flair for developing strategic IT solutions for diverse
clients, he has worked in the world of computers in 8 countries, and has
traveled to over 30 in the last 10 years. A veteran of numerous global pro-
jects, Robin has honed his skills across a wide variety of businesses, plat-
forms, and technologies. He has managed to scratch his head and look
slightly confused in the world of security, network operating systems,
development, and research.
Having traversed the globe and seen its many beautiful wonders,
Robin is still captivated by the one thing that leaves him breathless—
Natalie, his wife. She is a light against the darkness, a beauty whose smile
can melt even the coldest heart.
Teri Bidwell
(GCIA) has been involved in Internet security for over 10
years as an analyst, engineer, and administrator and is a SANS-Certified
GCIA Intrusion Analyst. Her career began securing Unix networks at the
University of Colorado and continued as a Cisco network engineer and
DNS manager for Sybase, Inc.Today,Teri is a security analyst for a firm
headquartered in Reston,VA. She is a key contributor to corporate secu-
rity strategy and is an advisor for e-business development. Her specialties
include policy creation, vulnerability assessment, penetration testing, and
intrusion detection for corporate environments.
Teri received a Computer Science degree from the University of
Colorado and sits on the SANS GCIA Advisory Board. She currently
lives and works in Boulder, CO with her family, Clint,Wes, and Michael.
Michael Cross
(MCSE, MCP+I, CNA) is a Microsoft Certified System
Engineer, Microsoft Certified Product Specialist, Microsoft Certified
Professional + Internet, and a Certified Novell Administrator. Michael is
the Network Administrator, Internet Specialist, and a Programmer for the
Niagara Regional Police Service. He is responsible for network security

and administration, programming applications, and is Webmaster of their
Web site at www.nrps.com. He has consulted and assisted in computer-
related/Internet criminal cases, and is part of an Information Technology
134_ecomm_FM 6/19/01 11:49 AM Page viii
ix
team that provides support to a user base of over 800 civilian and uniform
users. His theory is that when the users carry guns, you tend to be more
motivated in solving their problems.
Michael owns KnightWare, a company that provides consulting, pro-
gramming, networking,Web page design, computer training, and other
services. He has served as an instructor for private colleges and technical
schools in London, Ontario Canada. He has been a freelance writer for
several years and has been published over two dozen times in books and
anthologies. Michael currently resides in St. Catharines, Ontario Canada
with his lovely fiancée Jennifer.
Oliver Steudler
(CCNP, CCDP, CSE, CNE) is a Senior Systems
Engineer at iFusion Networks in Cape Town, South Africa. Oliver spe-
cializes in routing, switching, and security and has over 10 years of experi-
ence in consulting, designing, implementing, and troubleshooting
complex networks. He has written articles on TCP/IP, networking, secu-
rity, and data communications and also co-authored another Syngress title,
Managing Cisco Network Security (ISBN: 1-928994-17-2).
Kevin Ziese
is a computer scientist at Cisco Systems, Inc. Prior to
joining Cisco, he was a senior scientist and founder of the Wheelgroup
Corporation, which was acquired by Cisco Systems in April of
1998. Before founding the Wheelgroup Corporation, he was Chief of the
Advanced Countermeasures Cell at the Air Force Information Warfare
Center.

134_ecomm_FM 6/19/01 11:49 AM Page ix
x
L. Brent Huston
earned his Associate of Applied Science degree in
Electronics at DeVry Technical Institute (Columbus, Ohio) in 1994. He
has more than 10 years of experience in IT, mostly in the areas of cyber
security testing, network monitoring, scanning protocols, firewalls, viruses
and virus prevention formats, security patches, and hacker techniques. As
President and CEO of his own information security company,
MicroSolved, Inc., he and his staff have performed system and network
security-consulting services for Fortune 500 companies and all levels of
governmental facilities. He is well versed in the use and implementation
of all the major security tools and appliances. In the past, Brent developed
“Passys”—a passive intrusion detection system for Unix and has also iden-
tified previously unknown security vulnerabilities in Ascom routers,
Windows NT, and Linux operating systems.
Brent is an accomplished computer and information security speaker
and has published numerous white papers on security-related topics.
Recently he was involved in the laboratory testing of major firewall appli-
ances at his company’s central Ohio facilities.This testing was to prove the
worthiness of each appliance as well as possible vulnerabilities that had
not as yet been established by their parent companies. He reported his
results both to the individual product companies and at a national security
industry presentation. Brent is also currently engaged with the Office of
Independent Oversight and Performance Assurance in Columbus, OH.
He was responsible for designing and implementing a state-of-the-art
cyber security testing and research lab for this office and several DOE
national laboratories have utilized his expertise to perform network pene-
tration and detection services. Such services have required a high security
clearance from Brent. Brent is an Internet Security Systems Certified

Engineer, Sidewinder Firewall Certified Administrator, IBM Secure
Network Gateway Certified Administrator, and Phoenix Firewall
Certified Administrator.
Technical Editor
and Contributor
134_ecomm_FM 6/19/01 11:49 AM Page x
Contents
xi
Foreword xxv
Chapter 1 Applying Security
Principles to Your E-Business 1
Introduction 2
Security as a Foundation 3
Confidentiality 3
Integrity 4
Availability 4
Presenting Security As More Than
a Buzzword 6
The Goals of Security in E-Commerce 9
Planning with Security in Mind 10
Security during the Development Phase 13
Implementing Secure Solutions 14
Managing and Maintaining Systems in
a Secure Environment 15
Applying Principles to Existing Sites 20
It All Starts with Risk 21
Fix the Highest Risks First 22
Management and Maintenance during
the Patching Process 23
Impact of Patching on Production

Systems 24
The Never-Ending Cycle of Change 25
Developing a Migration Plan 26
How to Justify a Security Budget 27
The Yardstick Approach 27
Understand the Goals
of Security in the
Commerce Process
■
Protect the privacy of
the consumer at the
point of purchase.
■
Protect the privacy of
the customers’
information while it is
stored or processed.
■
Protect the
confidential identity of
customers, vendors,
and employees.
■
Protect the company
from waste, fraud, and
abuse.
■
Protect the
information assets of
the company from

discovery and
disclosure.
■
Preserve the integrity
of the organization’s
information assets.
■
Ensure the availability
of systems and
processes required for
consumers to do
business with the
company.
■
Ensure the availability
of systems and
processes required for
the company to do
business with its
vendors and partners.
134_ecomm_TOC 6/19/01 11:47 AM Page xi
xii Contents
A Yardstick Approach Case Study 29
Possible Results of Failure 30
The Fear Tactic Approach 31
A Fear Tactic Approach Case Study 32
Possible Results of Failure 34
Security as a Restriction 35
Security as an Enabler 36
Summary 38

Solutions Fast Track 39
Frequently Asked Questions 43
Chapter 2 DDoS Attacks:
Intent, Tools, and Defense 45
Introduction 46
What Is a DDoS Attack? 47
Laying the Groundwork: DoS 48
Resource Consumption Attacks 50
Malformed Packet Attacks 57
Anatomy of a DDoS attack 60
The Attacks of February 2000 63
Why Are E-Commerce Sites Prime Targets
for DDoS? 67
A Growing Problem 68
How the Media Feeds the Cycle 69
What Motivates an Attacker to Damage
Companies? 70
Ethical Hacking: A Contradiction in Terms? 70
Hacktivism 72
Fifteen Minutes of Fame 72
Hell Hath No Fury Like a Hacker Scorned 73
Show Me the Money! 73
Malicious Intent 74
What Are Some of the Tools Attackers Use
to Perform DDoS Attacks? 75
Trinoo 76
Understanding How Trinoo Works 76
Damage & Defense
Sidebars Provide You
with Additional

Information on
Minimizing Risk
Damage & Defense…
Configuration
Management
One method of instigating
a DoS is by altering the
configuration of key
devices such as routers
and servers. Routing
tables, registry databases,
and UNIX configuration
files are just a few of the
potential configuration
databases that can be
used against a business. It
goes without saying, then,
that all Internet-facing
devices should undergo
strict change control
procedures and that a
backup of the last known
good configuration
should be available on
134_ecomm_TOC 6/19/01 11:47 AM Page xii
Contents xiii
TFN2K:The Portable Monster 78
Understanding How TFN2K Works 78
Stacheldraht—A Barbed-Wire Offensive 81
Understanding How Stacheldraht Works 81

More DDoS Families 86
How Can I Protect My Site against These
Types of Attacks? 87
Basic Protection Methods 90
Using Egress Rules to Be a
Better “Net Neighbor” 95
Defending against the SYN’s of
the Internet 99
Methods for Locating and Removing
Zombies 103
Summary 109
Solutions Fast Track 111
Frequently Asked Questions 117
Chapter 3 Secure Web Site Design 119
Introduction 120
Choosing a Web Server 121
Web Server versus Web Service 121
Factoring in Web Servers’ Cost and
Supported Operating Systems 122
Comparing Web Servers’ Security Features 127
Authentication 127
Using the SET Protocol 133
Setting Permissions 134
Using CGI Applications 134
Security Features Side By Side 134
The Basics of Secure Site Design 143
Creating a Security Plan 143
Protecting against Internal Threats 145
Adding Security Tiers beyond the
Web Server 146

Apache versus Internet Information Services 149
Installation:The First Step 151
Know What You May
Be Giving Away in
Your HTML Code
Each hidden tag can be
used with forms on your
site and includes a name
and a value. When the
form is submitted, the
name and value in the
hidden field is included
with the results. For
example, the following
line of code shows an
input value of $100.00
associated with a variable
called "cost."
<input type=hidden
name="cost"
value="100.00">
Using a text editor or
HTML editing program, a
hacker could alter the
value so that the value is
changed to a lower
amount. For example, the
$100.00 could be changed
to $1.00. This would allow
buyers to purchase

products at a significantly
reduced amount.
134_ecomm_TOC 6/19/01 11:47 AM Page xiii
xiv Contents
Installing and Configuring Apache 152
Installing and Configuring Internet
Information Server 5.0 164
Windows 2000 Server and Internet
Information Server 5.0 Security 168
Hardening the Server Software 173
Install Patches 174
Disable Unneeded Ports, Services, and
Components 174
Delete Unneeded Scripts and Files 175
Hardening the Overall System 176
Password Hacking and Analysis Tools 178
Web Design Issues Dealing with HTML
Code 183
Information in HTML Code 183
Using Server Side Includes (SSI) in
HTML Code 186
Guidelines for Java, JavaScript, and Active X 189
Understanding Java, JavaScript, and
ActiveX—and the Problems They
May Cause 189
Preventing Problems with Java,
JavaScript, and ActiveX 191
Programming Secure Scripts 196
Code Signing: Solution or More Problems? 199
Understanding Code Signing 199

The Strengths of Code Signing 200
Problems with the Code Signing Process 201
Should I Outsource the Design of My Site? 202
Understanding the Required Skills 203
Pros and Cons of Outsourcing Design Work 204
Workload 204
Security 205
Contracts and Cost 206
No Matter Who Designs It, Double-Check
before You Implement It 207
134_ecomm_TOC 6/19/01 11:47 AM Page xiv
Contents xv
Summary 209
Solutions Fast Track 210
Frequently Asked Questions 214
Chapter 4 Designing and Implementing
Security Policies 219
Introduction 220
Why Are Security Policies Important to an
E-Commerce Site? 220
What Is a Security Policy? 221
Value versus Risk 222
Security versus Services Provided 223
Cost of Security versus Cost of Not
Having Security 224
Where Do I Begin? 225
What Elements Should My Security Policy
Address? 228
Confidentiality and Personal Privacy Policies 230
Requirements for Authentication 231

Requirements for Protecting Customer
Information 236
Privacy Policies 239
Information Integrity Policies 240
Quality Assurance Policies 241
Assuring Information Integrity through
Technology 244
Availability of Service Policies 244
Are Prewritten Security Policies Available on
the Net? 246
All Organizations Are Different—and So
Are Their Policies 246
Example Policies and Frameworks 247
A Word about the Outsourcing of Policy
Development 248
How Do I Use My Security Policy to
Implement Technical Solutions? 248
Learn How to Produce a
Security Policy
Policy
Research
New Security
Issue
Baseline Policy
Solicit
Feedback
Identify Key
Stakeholders
Review
Procedure

Conduct
Review
Workshop
Proposed
Policy Draft
Final Policy
Draft
Executive
Approval
Edit
Draft
Policy
Publication
Legal Review
End User
Training
134_ecomm_TOC 6/19/01 11:47 AM Page xv
xvi Contents
How Do I Inform My Clients of My
Security Policies? 251
Building Customer Confidence through
Disclosure 252
Security as a Selling Point 253
Summary 254
Solutions Fast Track 255
Frequently Asked Questions 259
Chapter 5 Implementing a Secure
E-Commerce Web Site 261
Introduction 262
Introduction to E-Commerce Site

Components 262
Implementing Security Zones 264
Introducing the Demilitarized Zone 266
Multiple Needs Equals Multiple Zones 268
Problems with Multi-Zone Networks 271
Understanding Firewalls 272
Exploring Your Firewall Options 272
Designing Your Firewall Rule Set 275
It Starts with a “Deny All” Attitude 276
Common Ports for Common
Communications 276
Converting Pseudo-Code to Firewall
Rules 278
Protocols and Risks: Making Good
Decisions 279
How Do I Know Where to Place My
Components? 280
Profiling Systems by Risk 280
Establishing Risk Control Requirements 282
Creating Security Zones through
Requirement Grouping 283
Implementing Intrusion Detection 283
What Is Intrusion Detection? 285
Your Choices in Intrusion Detection 286
Chapter 5 Answers All
Your Questions About
Implementing a
Secure Site
Q:
How do I know if I am

logging too much or
too little information
on my systems?
A:
Log the information
you feel that you need
to make good
decisions. If you have
problems sifting
through the logs to
locate issues and you
have had proper
training, then you need
to eliminate the log
entries that you do not
use to make decisions
or keep those log
entries and use an
automated tool to
select only the entries
you are interested in.
You are logging too
little information if you
do not have a picture
of your systems’
operations and your
users’ behaviors.
134_ecomm_TOC 6/19/01 11:47 AM Page xvi
Contents xvii
Network-Based IDS 288

Host-Based IDS 290
Example of a Network-Based IDS 292
Example of a Host-Based IDS 293
Managing and Monitoring the Systems 295
What Kind of Management Tasks Can
I Expect to Perform? 295
What Kinds of Monitoring Should I Be
Performing? 296
Basic System Monitoring 298
Monitoring Your Security Devices 299
Log File Management 300
Should I Do It Myself or Outsource My Site? 301
Pros and Cons of Outsourcing Your Site 302
Co-Location: One Possible Solution 303
Selecting an Outsource Partner or ASP 303
Summary 305
Solutions Fast Track 305
Frequently Asked Questions 311
Chapter 6 Securing Financial Transactions 313
Introduction 314
Understanding Internet-Based Payment
Card Systems 315
Credit, Charge, or Debit Cards:What Are
the Differences? 315
Point-of-Sale Processing 317
Differences That Charge Cards
Bring into the Picture 318
Capture and Settlement 319
Steps in an Internet-Based Payment
Card Transaction 321

Toxic Data Lives Everywhere! 325
Approaches to Payments via the Internet 326
Options in Commercial Payment Solutions 327
Commerce Server Providers 328
Braving In-house Resources 329
134_ecomm_TOC 6/19/01 11:47 AM Page xvii
xviii Contents
Secure Payment Processing Environments 331
Additional Server Controls 335
Controls at the Application Layer 336
Understanding Cryptography 337
Methodology 337
Substitution Method 337
Transposition Method 338
Transposition Example 339
The Role of Keys in Cryptosystems 342
Symmetric Keys 342
Asymmetric Keys 342
Principles of Cryptography 343
Understanding Hashing 344
Digesting Data 345
Digital Certificates 348
CCITT X.509 349
Examining E-Commerce Cryptography 351
Hashing Functions 351
Block Ciphers 352
Implementations of PPK Cryptography 352
The SSL Protocol 353
Transport Layer Security (TLS) 355
Pretty Good Privacy (PGP) 356

S/MIME 357
Secure Electronic Transactions (SET) 357
XML Digital Signatures 359
Virtual POS Implementation 362
ICVERIFY 362
Alternative Payment Systems 364
Smart-Card-Based Solutions 365
EMV 365
MONDEX 367
Visa Cash 368
The Common Electronic Purse
Specification (CEPS) 369
Proxy Card Payments 369
PayPal 370
Complete Coverage of
Third Party Merchants'
POS Systems.
ICVERIFY's features include
the following:
■
Importing credit card
transaction data from
other PC applications,
such as spreadsheets or
databases.
■
Offline group mode to
submit a batch of
transactions at one
time for authorization.

■
Support for Address
Verification Systems
(AVSs), Retail AVSs,
CVV2s, and CVC2s to
help reduce fraud due
to stolen or fraudulent
cards.
■
Data import analysis of
files for errors before
import.
134_ecomm_TOC 6/19/01 11:47 AM Page xviii
Contents xix
Amazon Payments 370
Funny Money 371
Beenz 371
Flooz 371
Summary 372
Solutions Fast Track 373
Frequently Asked Questions 379
Chapter 7 Hacking Your Own Site 381
Introduction 382
Anticipating Various Types of Attacks 382
Denial of Service Attacks 382
Information Leakage Attacks 384
File Access Attacks 385
Misinformation Attacks 386
Special File/Database Access Attacks 387
Elevation of Privileges Attacks 388

Performing a Risk Analysis on Your Site 389
Determining Your Assets 390
Why Attackers Might Threaten Your Site
and How to Find Them 392
Testing Your Own Site for Vulnerabilities 395
Determining the Test Technique 396
Researching Your Vulnerabilities 399
Mapping Out a Web Server 407
Using Automated Scanning Tools 409
Hiring a Penetration Testing Team 414
Summary 418
Solutions Fast Track 419
Frequently Asked Questions 423
Chapter 8 Disaster Recovery
Planning: The Best Defense 425
Introduction 426
What Is Disaster Recovery Planning? 426
Structuring a Disaster Recovery Plan 428
Loss of Data or Trade Secrets 429
Tools & Traps, Security
Alerts, and Damage &
Defense Sidebars
Make Sure You Don’t
Miss a Thing:
Tools & Traps…Gauge
Your Threat Level with a
Honeypot
A honeypot (in an
information security
context) is a system that is

designed to be broken
into. Setting up a
honeypot will give you an
opportunity to study
tactics of attackers and
possibly pick up a new
attack or two along the
way. Naturally, the
attacker shouldn’t be
aware that he has broken
into a honeypot, and he
should think that he’s
gotten into an ordinary
machine with no special
monitoring. In fact, a
honeypot machine
typically has extensive
monitoring in place
around it, either on the
machine itself or via the
network. In order for the
honeypot to be effective,
as much information as
possible must be collected
about the attacker.
134_ecomm_TOC 6/19/01 11:47 AM Page xix
xx Contents
Loss of Access to Physical Systems 431
Loss of Personnel or Critical Skill Sets 436
Practicing Compliance with Quality

Standards 436
Ensuring Secure Information Backup and
Restoration 438
The Need for Backups and Verification 439
An Example Backup Rotation Process 440
Storage Area Networks 442
Protecting Backups of Sensitive Information 443
User Authentication 444
Data Encryption and Controls 445
Key Management 446
Planning for Hardware Failure or Loss of
Services 447
The Single Point of Failure Problem 448
ISP Redundancy 449
Network Hardware Redundancy 451
System Hardware Redundancy 451
Expanding the Scope of Your Solutions 453
How Do I Protect against Natural Disasters? 454
Hot Sites:The Alternate Path to Recovery 455
How Do I Choose a Hot Site? 456
Testing the Process 456
Understanding Your Insurance Options 457
Errors and Omissions Coverage 458
Intellectual Property Liability 459
First Party E-Commerce Protection 460
Determining the Coverage You Need 461
Financial Requirements 463
The Delicate Balance: Insurance and
the Bottom Line 464
Coverage That May Not Be Needed 464

Summary 466
Solutions Fast Track 467
Frequently Asked Questions 472
Chapter 8 Answers All
Your Questions About
Disaster Recovery
Planning:
Q:
How does e-commerce
insurance pay out
benefits when I incur a
loss?
A:
Types of insurance
payout provisions are
"Pay on Behalf" versus
"Indemnification." Pay
on Behalf takes care of
expenses as they are
incurred by the insured
and works a bit like
homeowner’s
insurance. If the policy
covers your defense in
a lawsuit, the legal
fees will be paid as
they are incurred.
Indemnification
reimburses the insured
for covered expenses

already incurred and
works a bit like
traditional health
insurance. You pay for
the covered expense
and then apply for
reimbursement from
the insurer. Most
insurance offerings for
e-commerce are of the
"Pay on Behalf" variety.
Q:
What’s the difference
between a password
and a passphrase?
A:
A passphrase has
spaces in it and is
made up of multiple
words. "ex&mpl3" is a
password and "4 sc0re
& s3v3n ye4r5 @go" is
a passphrase.
134_ecomm_TOC 6/19/01 11:47 AM Page xx
Contents xxi
Chapter 9 Handling Large Volumes
of Network Traffic 475
Introduction 476
What If My Sites Popularity Exceeds My
Expectations? 476

Determining the Load on Your Site 478
Determining Router Load 479
Determining Switch Load 483
Determining Load Balancer Load 484
Determining Web Server Load 485
Performance Tuning the Web Server 488
How Do I Manage My Bandwidth Needs? 493
Contracting for Bandwidth 493
Estimating Required Service Levels 496
How Do I Know When I Need More
Bandwidth? 497
Obtaining Bandwidth on Demand 498
Introduction to Load Balancing 499
What Is Load Balancing? 500
Changing the Destination MAC Address 501
Modifying the IP Addresses 502
Using a Proxy Server 503
Finding a Custom Software/Clustering
Solution 504
Determining Load 504
The Pros and Cons of Load Balancing 505
Load Balancing and Security 505
Summary 509
Solutions Fast Track 510
Frequently Asked Questions 512
Chapter 10 Incident Response,
Forensics, and the Law 515
Introduction 516
Why Is an Incident Response Policy Important? 516
Panic or Be Calm:You Decide 516

How Not to Handle an Incident 517
Understand Load
Balancing and Security
For the most part, load
balancers don’t change
security much, and in fact
some can enhance it by
acting as limited firewalls.
However, in a few cases,
security may be impacted.
Obviously the load
balancer itself may have
security problems—most
products do. Attacks
against the management
interface or address of the
load balancer may occur.
In this sense, it’s much like
any system on your
network, which might be
compromised and give an
attacker better leverage
for other attacks. If an
attacker manages to gain
administrative control over
your load balancer, they
might be able to cause a
"virtual defacement" by
redirecting your Web
traffic to a page of their

choosing.
134_ecomm_TOC 6/19/01 11:47 AM Page xxi
xxii Contents
Proper Policy Pays Off 518
Incident Response Policy Recap 524
Establishing an Incident Response Team 525
Setting the Prosecution Boundaries 526
Attackers Crossing the Line 526
Understanding the Chain of Custody 529
Establishing an Incident Response Process 530
Introduction to Forensic Computing 531
Tracking Incidents 538
Resources 542
Legal/Government/Law Enforcement 542
Backup/Forensics 542
Incident Tracking Systems 543
Miscellaneous 544
Summary 545
Solutions Fast Track 546
Frequently Asked Questions 550
Appendix A Cisco Solutions
for Content Delivery 553
Introduction 554
Improving Security Using Cisco LocalDirector 555
LocalDirector Technology Overview 555
LocalDirector Product Overview 556
LocalDirector Security Features 557
Filtering of Access Traffic 557
Using synguard to Protect against
SYN Attacks 557

Using Network Address Translation
to Hide Real Addresses 559
Restricting Who Is Authorized to
Have Telnet Access to the
LocalDirector 560
Password Protection 561
Syslog Logging 562
Security Geographically Dispersed Server
Farms Using Cisco DistributedDirector 563
Maintain a Chain of
Custody List
■
Who was in custody
(possession) of the
evidence?
■
Where was the
evidence?
■
What security
measures are in place
at that location?
■
What items of
evidence existed at
that time?
134_ecomm_TOC 6/19/01 11:47 AM Page xxii
Contents xxiii
DistributedDirector Technology Overview 563
DistributedDirector Product Overview 565

DistributedDirector Security Features 565
Limiting the Source of DRP Queries 565
Authentication between
DistributedDirector and DRP Agents 566
Password Protection 568
Syslog Logging 570
Improving Security Using the Cisco Content
Services Switch 570
Content Services Switch Technology
Overview 571
Content Services Switch Product Overview 572
Content Services Switch Security Features 573
FlowWall Security 573
Using Network Address Translation
to Hide Real Addresses 574
Firewall Load Balancing 575
Password Protection 576
Disabling Telnet Access 577
Syslog Logging 578
Known Security Vulnerabilities 578
Summary 580
Frequently Asked Questions 581
Appendix B Hack Proofing Your
E-Commerce Site Fast Track 583
Index 625
134_ecomm_TOC 6/19/01 11:47 AM Page xxiii
134_ecomm_TOC 6/19/01 11:47 AM Page xxiv