E-Commerce

1. Accidental actions
This category encompasses problems arising from basic lack of knowledge about online security concepts and includes issues such as poor password choices, accidental or erroneous business transactions, accidental disclosure, and erroneous or outdated software.
Related problems occur as a result of misconfigured security products and information leakage resulting from insecure information transfers.

2.Malicious attacks

• Attack that specifically aims harm computers.
• Types of Malicious attacks:

a.Computer Virus:

-It is the most common form of malicious code.
-It is a program that attaches itself to other program.
-Major types of virus:
i. File Infectors
ii. System or boot-record infectors
iii. Macro Viruses
iv. Multi-part

-Example of computer virus:
I.
“Melissa” virus/worm - It will cause computer show down and face frequent failure.
II.
“I Love You” virus - A small piece of code attached to electronic mail which will cause an e-mail send to everyone in an address book, then damaging victims' machines.

III.Trojan horse - Personal information will be stolen as Trojan track into the computer.


b.Denial of Service Attacks (DoS)

• It is an attack on a web site that uses specialized software to send a flood of data packets to the target computer with the intention of overloading its resources and cause the network shut down.

c.Distributed denial-of-service attack (DDoS)

• A DoS attacks that gains illegal administrative access to as many computers on the internet as possible and uses these multiple computers to send a flood of data pockets to the target computer.

3.Online fraud

• It is a broad term covering Internet transactions that involve falsified information.
• Types of Online fraud:

a.Identity Theft

-Electronic commerce information can be intercepted as a result of vulnerabilities in computer security. Thieves can then take information such as credit card numbers and misuse on it.

b.Data Theft

-A term used to describe not only the theft of information but also unauthorized perusal or manipulation of private data.

• Use and update anti-virus software, anti spyware software and firewall frequently.
• Be aware of email attachments from unknown sources.
• Develop a strong password and change them frequently.
• Do not download free software unless you have verified that it is legitimate.
• Stay away from 'questionable' websites.
• Be cautious of pop-ups.
• Back up your data frequently.
• Always delete cookies in the computer to prevent track on the history/password.
  

In conclusion, we should prepare well before online to secure us being threat of online security.

Related Links: http://www.bsagovernment.com/downloads/MajorOnlineThreats.pdf http://www.vermontpcsolutions.com/articles/10-free-ways-to-help-prevent-malware-threats.html

3rd party certification program is used to ensure that the original content of an electronic document is safeguarded from being changed by unauthorized person. Certificate Authorities (CAs) are third parties that issue digital certificates which used to authenticate websites, individuals and software companies.



MSC Trustgate is a licensed Certification Authority (CA) in Malaysia since 1999. They offer security solutions that are needed by individuals, enterprises, government, and e-commerce service providers using digital certificates, digital signatures, encryption and decryption.

It’s very important for an organization to ensure the security of their confidential data. Therefore, they can use certificates to secure their data and manage identification credentials from users and computers within and outside your organization. Examples of the certificates are:

Public Key Infrastructure (PKI)
PKI is a combination of software, encryption technologies, processes and services which safeguard communications and business transaction. It is done by exchanging digital certificates between authenticated users and trusted resources. By using PKI, an organization can achieve its objective of Confidentiality, Integrity, Authenticity and Non-repudiation of data.

Digital ID
Everyday, there are millions of transactions being carried out over the unsecured network. These transactions normally contain information such as customer’s details, company’s pricing decision and other highly confidential information. Such information can be easily altered if not properly encrypted. Examples of Digital ID are CryptoSuite and Secured E-mail.

Therefore, Digital ID provides protection to this information so that such information remains private in its transferring process by signing and encrypting transaction. It uses private key and public key performs following operations that supplement PKI:

Authentication

• Verification of real identity of an individual, computer, computer program & E-Commerce websites.

• Assurance of confidential data remains private

Authorization

• Assurance that only authorized users have rights access to private data

Integrity

• Assurance that stored data have not been amended without authorization

Non-repudiation

• Assurance that online users cannot falsely deny or repudiate their transaction
  
  

VeriSign



Furthermore, VeriSign is also one of the programs used by organization in Malaysia. MSC Trustgate is the first company in Asia which appointed as VeriSign Authorized Training Centre. VeriSign provides various types of security products such as digital certificates, payment processing, managed firewalls to mobile call roaming, toll free call database queries and downloadable digital content for mobile devices.


MyKey



Besides Organization, Malaysian Government is also applying 3rd party certification program in National Identity Card (MyKad) of every citizen. MyKey is the PKI solution that works with our MyKad which allows us to conduct several Internet activities such as online submission of tax return, online banking and digitally sign documents.