Unit 4.2
Major E-commerce Security Threats
Learning Objectives
By the end of this chapter, you will be able to:
- ✅ Identify the major security threats in e-commerce.
- ✅ Define malware, phishing, and denial-of-service attacks.
- ✅ Recognize the signs and impact of common cyber attacks.
The E-commerce Threat Landscape
The digital environment is filled with threats that can compromise an online business. Understanding these is the first step toward effective defense.
- 🎯 Threats target valuable data (customer info, payment details).
- 🎯 Attacks can disrupt business operations, leading to financial loss.
- 🎯 Security breaches erode customer trust and damage brand reputation.
Threat 1: Malicious Code (Malware) 🐛
Malware: Software designed to harm or disrupt computer systems, steal data, or gain unauthorized access.
Viruses
Attach themselves to clean files and spread through the system, often corrupting data.
Worms
Self-replicating programs that exploit network vulnerabilities to spread to other computers.
Trojan Horses
Disguised as legitimate software to trick users into installing them, creating a backdoor for attackers.
Ransomware and Insider Threats
Ransomware
Malware that may encrypt data and demand payment; attackers may also steal data and threaten disclosure.
Priorities: reduce exposure, patch, restrict access and test recoverable backups.
Insider threat
A person with legitimate access may intentionally misuse it, or cause harm through error.
Priorities: least privilege, separate duties, review access and monitor sensitive actions.
A departing employee exports the customer list using their own authorized login. Is antivirus alone the right defense?
No. The action may use normal software. Access lifecycle controls and audit evidence matter; backups alone do not prevent data theft.
Back Up, Restore, Test
🐛 Identify the Malware Type
Match each scenario to the correct malware type:
Threat 2: Phishing 🎣
Phishing: A social engineering attack using fraudulent emails or websites to trick users into revealing sensitive information.
How It Works
- Impersonates a trusted entity (bank, e-commerce site).
- Creates a sense of urgency or fear.
- Directs user to a fake website to enter credentials.
What Attackers Want
- Usernames & Passwords
- Credit Card Numbers
- Bank Account Details
- Personal Identifying Information
🔍 Anatomy of a Phishing Email
Example: "Urgent Action Required"
From: NpBank Support <support-np@security-update.com>
Subject: Security Alert: Your Account Has Been Limited
Dear Valued Customer,
We detected unusual activity on your account. For your protection, we have temporarily suspended it. Please verify your identity immediately to restore access.
Click here to login and verify your details.
Thank you,
The NpBank Security Team
- Red Flag 1: Non-specific greeting ("Valued Customer").
- Red Flag 2: Suspicious sender email address.
- Red Flag 3: Creates a false sense of urgency.
🎣 Phishing Red Flag Spotter
Training example: clues are warning signs, not proof. Knowing your name does not authenticate a sender. Verify independently.
Click the highlighted parts of the email to reveal each red flag:
To: you@email.com
Subject: URGENT: Your Account Has Been SUSPENDED
Dear Valued Customer,
We detected suspicious activity. You must verify your identity within 24 hours or your account will be permanently closed.
Click here to secure your account now.
The NpBank Security Team
🎬 Watch: Pause, Check, Then Act
Phishing Changes Channel, Not Purpose
Smishing
SMS lures you to disclose credentials or authorize a payment.
Vishing
A voice caller impersonates support, a bank or another trusted party.
Spear phishing
A targeted message uses details about a person or organization.
“Support” calls with your name and says to read out your login OTP. Does knowing your name prove the caller is genuine?
No. End the interaction and contact the provider using its official app or a known contact path. Never share login OTPs or passwords with a caller.
Threat 3: Denial-of-Service (DoS) Attacks ⚡
DoS Attack: An attempt to make a website or network resource unavailable to its intended users by overwhelming it with a flood of traffic.
Denial-of-Service (DoS)
- Single source of attack traffic.
- Aims to exhaust the server's resources.
- Relatively easier to block by identifying and filtering the single source IP.
Distributed DoS (DDoS)
- Traffic comes from multiple sources (a "botnet").
- Much larger scale and harder to defend against.
- Difficult to distinguish legitimate user traffic from attack traffic.
⚡ DoS vs. DDoS: Traffic Flood Simulator
Predetermined animation, not measured network capacity. Layered DDoS mitigation exists; high traffic alone does not prove an attack.
🎬 Watch: Why Many Sources Overwhelm One Server
Worked Example: The Cost of Downtime
Illustrative festival shop: 120 orders/hour, Rs 1,500 average order value, 20% contribution margin. Checkout is unavailable for 2 hours. Assume all affected orders are lost, with no later recovery.
- Affected orders: 120 × 2 = 240.
- Revenue at risk: 240 × Rs 1,500 = Rs 360,000.
- Contribution at risk: Rs 360,000 × 20% = Rs 72,000.
If half the customers return later, how does the direct loss estimate change? What does this calculation leave out?
Direct contribution at risk falls to Rs 36,000. Recovery effort and reputation may add costs. Revenue is not profit, and high traffic alone does not prove an attack.
Other Significant Threats 📊
Data Breaches
The unauthorized access and theft of sensitive, protected, or confidential data. This can include customer credit card information, personal details, and business secrets.
Impact: Severe financial loss, regulatory fines, and catastrophic reputational damage.
Cybervandalism
The act of electronically defacing an existing website's pages, changing content, or even deleting the entire site. The motivation is often to disrupt business or make a political statement.
Impact: Erodes customer trust and can cause immediate loss of sales.
Real Case: Equifax, 2017
- The US Government Accountability Office reported that attackers gained unauthorized access to Equifax's online dispute portal in 2017.
- GAO described four factors identified by Equifax's investigation: identification, detection, database access segmentation and data governance.
- The attack exposed sensitive consumer information. Technology, monitoring and management decisions interacted; no single control was sufficient.
In pairs: identify the vulnerability, the business asset and one control that would require evidence rather than reassurance.
Consumer information was the asset at risk. Asset inventory, timely detection, restricted database access and accountable follow-up are complementary controls. The lesson applies to shops as well as credit bureaus.
Patch-to-Exposure Chain
💥 Threat Impact Assessor
All company-named scenarios and counts here are hypothetical; no company is accused. Loss rates are unverified examples, not Nepal benchmarks. Fines depend on applicable law.
A Nepali e-commerce site has been attacked. Choose the most likely primary impact:
🇳🇵 Practical Application: Threats in Nepal
Source-check note: the original 2017 ISP / 1.5-million assertion below is unverified; do not treat the date/count as established history.
Nepali e-commerce businesses and consumers face a growing number of security challenges.
- Phishing & Social Engineering: Attacks are increasingly common, targeting customers of banks and popular digital wallets like eSewa or Khalti to steal credentials.
- Data Breaches: High-profile incidents highlight the vulnerability of local systems.
Real-World Example: In 2017, a major Nepali ISP suffered a data breach that exposed the personal information of over 1.5 million customers.
- Malware: A persistent threat used to steal sensitive business data, disrupt operations, and damage a company's hard-earned reputation.
🇳🇵 Nepal Cyber Threat Quiz
All company-named scenarios and counts here are hypothetical; no company is accused. Loss rates are unverified examples, not Nepal benchmarks. Fines depend on applicable law.
Key Takeaways 🎯
The primary e-commerce threats are malicious code (malware), deceptive phishing attacks, and overwhelming DoS/DDoS attacks.
Phishing is a form of social engineering that preys on user trust to steal credentials and financial information.
A DoS/DDoS attack's goal is to shut down a website by flooding it with more traffic than it can handle, making it unavailable to legitimate customers.
🗣️ Discussion Questions
- What are the common signs that an email might be a phishing attempt?
- Why would an attacker launch a denial-of-service attack against an e-commerce website?
- What is the key difference between a DoS and a DDoS attack, and why does it matter for defense?
Exam Practice 📝
Short answer
- Distinguish between a virus and a worm.
- What is a Trojan horse? Give an example.
- What is phishing? Name two of its variants.
Long answer
- Explain the major security threats in the e-commerce environment with suitable examples.
- What is malicious code? Describe its different types and their effects on e-commerce businesses.
Revise the answers in the full note.
Sources & Media Credits
- Backup and patch-chain diagrams: made for IT204, CC BY 4.0.
- Videos: Keeper Security; PowerCert Animated Videos.
- Clip 1: source
- Clip 2: source
- Existing course illustrations/logos: retained; creator/licence metadata not supplied (provenance review pending). Sources: Types of Malware: Virus, Worm, Trojan; Anatomy of a Phishing Email; DDoS Attack Diagram; Data Breach Illustration; Cybersecurity in Nepal.
- GAO-18-559: Equifax breach
Thank You
Next Up: Unit 4.3 - Technology Solutions for E-commerce Security