Learning Objectives
By the end of this chapter, you will be able to:
- Identify the key technology solutions for e-commerce security.
- Distinguish symmetric key encryption from public key encryption.
- Explain how digital signatures, hash digests, and digital certificates provide integrity, authenticity, and nonrepudiation.
- Explain the role of SSL/TLS and VPNs in securing communications.
- Describe the function of firewalls, proxy servers, IDS/IPS, anti-malware software, and multi-factor authentication.
Technology Solutions for E-commerce Security
Several key technologies are used to protect e-commerce sites and their customers from security threats. No single tool is enough; they work in layers, so that an attacker who gets past one layer meets another.
flowchart LR
User[Customer Browser] -->|HTTPS / SSL-TLS| FW[Firewall]
FW --> Web[Web Server]
Web --> AV[Antivirus / Anti-malware]
AV --> IDS[IDS / IPS]
IDS --> Data[Protected Data Store]
Threat[External Threat] -.->|Blocked| FW
Threat -.->|Encrypted| User
Figure 1: Layered technology defenses for e-commerce security
1. Encryption
Encryption is the process of transforming plain text into a coded, unreadable format (ciphertext) using a key. Only someone with the right key can turn it back into plain text (decryption). Encryption protects data in transit (across the Internet) and at rest (stored in databases).
Symmetric key encryption
The sender and receiver use the same secret key to encrypt and decrypt. It is fast, which makes it good for large amounts of data. The problem is key distribution: the key must be shared secretly in advance, and a business would need a different key for every customer. Modern symmetric standards include AES (Advanced Encryption Standard).
Public key (asymmetric) encryption
Each person or organisation has a pair of keys:
- A public key, which anyone may know.
- A private key, which only the owner keeps.
What one key locks, only the other key can unlock. To send a confidential message to a shop, a customer encrypts it with the shop’s public key; only the shop’s private key can decrypt it. No secret has to be shared in advance, which solves the key-distribution problem. Public key encryption is slower, so in practice it is used to exchange a symmetric key, which then encrypts the rest of the session.
| Feature | Symmetric key | Public key (asymmetric) |
|---|---|---|
| Keys | One shared secret key | A public and private key pair |
| Speed | Fast | Slow |
| Key distribution | Hard: key must be shared secretly | Easy: public key can be published |
| Typical use | Encrypting bulk data | Exchanging keys, digital signatures |
2. Digital Signatures and Hash Digests
A hash function turns a message of any length into a short fixed-length value called a hash digest. If even one character of the message changes, the digest changes completely.
A digital signature is created when the sender encrypts the hash digest with their private key. The receiver:
- Decrypts the signature with the sender’s public key to get the original digest.
- Calculates a new digest from the message received.
- Compares the two. If they match, the message was not changed (integrity) and it must have come from the holder of the private key (authenticity and nonrepudiation).
A digital envelope combines both ideas: the message is encrypted with a fast symmetric key, and that key is encrypted with the receiver’s public key.
3. Digital Certificates and PKI
How does a customer know that a public key really belongs to the shop and not to an impostor? A digital certificate is an electronic document, issued by a trusted certification authority (CA), that binds a public key to a verified identity such as a company name and domain. It contains the owner’s name and public key, the certificate’s serial number and validity dates, and the CA’s own digital signature.
The system of CAs, certificates, and the procedures for issuing and checking them is called public key infrastructure (PKI). Browsers come with a list of trusted CAs and check each website’s certificate automatically. In Nepal, the Electronic Transactions Act provides for licensed certifying authorities under the Office of the Controller of Certification.
PKI has limits: a certificate proves who owns a domain, not that the business is honest, and a stolen private key or a careless CA can undermine the whole system.
4. SSL/TLS and HTTPS
SSL/TLS (Secure Sockets Layer / Transport Layer Security) is the standard technology for encrypting the communication between a user’s browser and a web server. SSL is the older name; current systems use TLS. When you see HTTPS and a padlock icon in your browser’s address bar, it means your connection is secured with TLS.
In a TLS connection:
- The browser connects to the server, and the server sends its digital certificate.
- The browser checks the certificate against its list of trusted CAs.
- Browser and server use public key methods to agree on a shared session key.
- The rest of the session is encrypted with that fast symmetric session key.
5. Virtual Private Networks (VPNs) and Wireless Security
A VPN creates an encrypted “tunnel” across the public Internet, so remote staff can connect to the company network as if they were in the office. Wi-Fi security standards such as WPA2 and WPA3 encrypt traffic on wireless networks; open Wi-Fi without encryption should never be used for admin or payment tasks without a VPN.
6. Firewalls and Proxy Servers
A firewall is hardware or software that filters traffic between a trusted internal network and the Internet according to security rules.
- Packet filters check the source, destination, and port of each packet.
- Application gateways inspect the content of requests for a specific application, such as a web application firewall (WAF) that blocks SQL injection attempts.
A proxy server sits between internal users and the Internet. It handles requests on their behalf, hides internal addresses, can block unsafe sites, and can cache content to speed up access.
7. Intrusion Detection and Prevention Systems
An Intrusion Detection System (IDS) monitors network or system activity and flags patterns that look like an attack — unusual login attempts, traffic spikes, or access to restricted files. Some IDS tools only alert administrators; Intrusion Prevention Systems (IPS) can block suspicious traffic automatically. In e-commerce, IDS/IPS sits alongside firewalls: the firewall filters traffic at the perimeter; IDS adds deeper inspection to catch threats that slip through or originate inside the network (for example, a compromised employee account).
8. Anti-malware and Endpoint Protection
Antivirus and anti-malware software detects, blocks, and removes viruses, worms, ransomware, and spyware on servers, staff computers, and phones. It must be updated constantly, along with operating systems and plugins, because new malware appears every day.
9. Authentication Technologies
- Passwords are the weakest link when they are short, reused, or shared.
- Multi-factor authentication (MFA) requires two or more of: something you know (password, PIN), something you have (phone receiving an OTP, a token), and something you are (fingerprint, face).
- Biometrics on phones are now common for opening banking and wallet apps.
- Tokenization replaces a card number with a random token, so the merchant never stores the real number.
Which Technology Protects Which Dimension?
| Technology | Dimensions protected |
|---|---|
| Encryption, TLS, VPN | Confidentiality, privacy |
| Hash digests, digital signatures | Integrity, authenticity, nonrepudiation |
| Digital certificates and PKI | Authenticity |
| Firewalls, IDS/IPS, proxies | Integrity, availability, confidentiality |
| Anti-malware | Integrity, availability |
| MFA and biometrics | Authenticity |
Adoption of Security Technologies in Nepal
The adoption of security technologies by e-commerce businesses in Nepal is still in its early stages. While many larger businesses are using a variety of security solutions, many smaller businesses are not.
Some of the most common security technologies that are being used by e-commerce businesses in Nepal include:
- SSL Certificates: SSL/TLS certificates are used by most major e-commerce, banking, and wallet websites in Nepal to encrypt the data sent between the customer and the website. Free certificates have made HTTPS affordable even for small shops.
- Multi-factor authentication: Banks and wallets use OTPs by SMS, transaction PINs, and fingerprint or face login in their apps.
- Firewalls: Firewalls are being used by many businesses to protect their networks from unauthorized access.
- Intrusion Detection Systems: Intrusion detection systems are being used by some of the larger businesses to monitor their networks for suspicious activity.
There are a number of challenges that businesses in Nepal face in implementing security technologies. These challenges include:
- Cost: The cost of security technologies can be a barrier for many small businesses.
- Lack of skilled personnel: There is a lack of skilled personnel in Nepal who can implement and manage security technologies.
- Lack of awareness: Many businesses in Nepal are not aware of the importance of security and the different security technologies that are available.
- Unpatched and pirated software: Unlicensed software often cannot be updated, leaving known weaknesses open.
Summary
A multi-layered approach is needed to secure an e-commerce environment. Symmetric encryption is fast but needs a shared secret; public key encryption solves key distribution and enables digital signatures, which use hash digests to prove integrity, authenticity, and nonrepudiation. Digital certificates issued by certification authorities, within a public key infrastructure, link public keys to real identities. TLS combines these ideas to secure web traffic (HTTPS), and VPNs secure remote connections. Firewalls, proxies, and IDS/IPS protect networks, anti-malware protects devices, and multi-factor authentication protects accounts.
Key Takeaways
- Symmetric encryption uses one key; public key encryption uses a public and private key pair.
- A digital signature is a hash digest encrypted with the sender’s private key.
- Digital certificates from CAs, within PKI, prove who owns a public key.
- TLS (HTTPS) uses certificates and a session key to encrypt web traffic.
- Firewalls, IDS/IPS, anti-malware, and MFA add further layers of protection.
Discussion Questions
- How can you tell if a website is using SSL/TLS to encrypt your connection?
- What is the difference between a firewall and antivirus software?
- Why is encryption alone not enough to secure an e-commerce site?
- Why do banks and wallets in Nepal ask for an OTP or fingerprint even after you log in?
Exam-Style Questions
Short answer
- Distinguish between symmetric key and public key encryption.
- What is a hash digest?
- What is a digital certificate? Who issues it?
- What is a firewall? Name its two main types.
- What is multi-factor authentication?
Long answer
- Explain how public key encryption, digital signatures, and digital certificates work together to secure e-commerce transactions.
- Describe the technology solutions used to protect e-commerce networks and servers.
- Discuss the adoption of security technologies by e-commerce businesses in Nepal and the challenges they face.
