HACK PROOFING YOUR E-COMMERCE SITE
CONTENTS CHAPTER 1 APPLYING SECURITY PRINCIPLES TO YOUR E-BUSINESS INTRODUCTION SECURITY AS A FOUNDATION CONFIDENTIALITY INTEGRITY AVAILABILITY PRESENTING SECURITY AS MORE THAN A BUZZWORD THE GOALS OF SECURITY IN E-COMMERCE PLANNING WITH SECURITY IN MIND SECURITY DURING THE DEVELOPMENT PHASE IMPLEMENTING SECURE SOLUTIONS MANAGING AND MAINTAINING SYSTEMS IN A SECURE ENVIRONMENT APPLYING PRINCIPLES TO EXISTING SITES IT ALL STARTS WITH RISK FIX THE HIGHEST RISKS FIRST MANAGEMENT AND MAINTENANCE DURING THE PATCHING PROCESS IMPACT OF PATCHING ON PRODUCTION SYSTEMS THE NEVER-ENDING CYCLE OF CHANGE DEVELOPING A MIGRATION PLAN HOW TO JUSTIFY A SECURITY BUDGET THE YARDSTICK APPROACH A YARDSTICK APPROACH CASE STUDY POSSIBLE RESULTS OF FAILURE THE FEAR TACTIC APPROACH A FEAR TACTIC APPROACH CASE STUDY SECURITY AS A RESTRICTION SECURITY AS AN ENABLER SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 DDOS ATTACKS: INTENT, TOOLS, AND DEFENSE WHAT IS A DDOS ATTACK? LAYING THE GROUNDWORK: DOS RESOURCE CONSUMPTION ATTACKS MALFORMED PACKET ATTACKS ANATOMY OF A DDOS ATTACK THE ATTACKS OF FEBRUARY WHY ARE E-COMMERCE SITES PRIME TARGETS FOR DDOS? A GROWING PROBLEM HOW THE MEDIA FEEDS THE CYCLE WHAT MOTIVATES AN ATTACKER TO DAMAGE COMPANIES? ETHICAL HACKING:A CONTRADICTION IN TERMS? HACKTIVISM FIFTEEN MINUTES OF FAME HELL HATH NO FURY LIKE A HACKER SCORNED SHOW ME THE MONEY! MALICIOUS INTENT WHAT ARE SOME OF THE TOOLS ATTACKERS USE TO PERFORM DDOS ATTACKS? TRINOO UNDERSTANDING HOW TRINOO WORKS TFN2K:THE PORTABLE MONSTER UNDERSTANDING HOW TFN2K WORKS STACHELDRAHT—A BARBED-WIRE OFFENSIVE UNDERSTANDING HOW STACHELDRAHT WORKS MORE DDOS FAMILIES HOW CAN I PROTECT MY SITE AGAINST THESE TYPES OF ATTACKS? BASIC PROTECTION METHODS USING EGRESS RULES TO BE A BETTER “NET NEIGHBOR” DEFENDING AGAINST THE SYN’S OF THE INTERNET METHODS FOR LOCATING AND REMOVING ZOMBIES CHAPTER 3 SECURE WEB SITE DESIGN CHOOSING A WEB SERVER WEB SERVER VERSUS WEB SERVICE FACTORING IN WEB SERVERS’ COST AND SUPPORTED OPERATING SYSTEMS COMPARING WEB SERVERS’ SECURITY FEATURES AUTHENTICATION USING THE SET PROTOCOL SETTING PERMISSIONS USING CGI APPLICATIONS SECURITY FEATURES SIDE BY SIDE THE BASICS OF SECURE SITE DESIGN CREATING A SECURITY PLAN PROTECTING AGAINST INTERNAL THREATS ADDING SECURITY TIERS BEYOND THE WEB SERVER APACHE VERSUS INTERNET INFORMATION SERVICES INSTALLATION:THE FIRST STEP INSTALLING AND CONFIGURING APACHE WINDOWS 2000 SERVER AND INTERNET INFORMATION SERVER 50 SECURITY HARDENING THE SERVER SOFTWARE INSTALL PATCHES DISABLE UNNEEDED PORTS, SERVICES, AND COMPONENTS DELETE UNNEEDED SCRIPTS AND FILES HARDENING THE OVERALL SYSTEM PASSWORD HACKING AND ANALYSIS TOOLS WEB DESIGN ISSUES DEALING WITH HTML CODE INFORMATION IN HTML CODE USING SERVER SIDE INCLUDES (SSI) IN HTML CODE GUIDELINES FOR JAVA, JAVASCRIPT, AND ACTIVE X UNDERSTANDING JAVA, JAVASCRIPT, AND ACTIVEX—AND THE PROBLEMS THEY MAY CAUSE PREVENTING PROBLEMS WITH JAVA, JAVASCRIPT, AND ACTIVEX PROGRAMMING SECURE SCRIPTS CODE SIGNING: SOLUTION OR MORE PROBLEMS? UNDERSTANDING CODE SIGNING THE STRENGTHS OF CODE SIGNING PROBLEMS WITH THE CODE SIGNING PROCESS SHOULD I OUTSOURCE THE DESIGN OF MY SITE? UNDERSTANDING THE REQUIRED SKILLS PROS AND CONS OF OUTSOURCING DESIGN WORK WORKLOAD SECURITY CONTRACTS AND COST NO MATTER WHO DESIGNS IT, DOUBLE-CHECK BEFORE YOU IMPLEMENT IT CHAPTER 4 DESIGNING AND IMPLEMENTING SECURITY POLICIES WHY ARE SECURITY POLICIES IMPORTANT TO AN E-COMMERCE SITE? WHAT IS A SECURITY POLICY? VALUE VERSUS RISK SECURITY VERSUS SERVICES PROVIDED COST OF SECURITY VERSUS COST OF NOT HAVING SECURITY WHERE DO I BEGIN? WHAT ELEMENTS SHOULD MY SECURITY POLICY ADDRESS? CONFIDENTIALITY AND PERSONAL PRIVACY POLICIES REQUIREMENTS FOR AUTHENTICATION REQUIREMENTS FOR PROTECTING CUSTOMER INFORMATION PRIVACY POLICIES INFORMATION INTEGRITY POLICIES QUALITY ASSURANCE POLICIES ASSURING INFORMATION INTEGRITY THROUGH TECHNOLOGY AVAILABILITY OF SERVICE POLICIES ARE PREWRITTEN SECURITY POLICIES AVAILABLE ON THE NET? ALL ORGANIZATIONS ARE DIFFERENT—AND SO ARE THEIR POLICIES EXAMPLE POLICIES AND FRAMEWORKS A WORD ABOUT THE OUTSOURCING OF POLICY DEVELOPMENT HOW DO I USE MY SECURITY POLICY TO IMPLEMENT TECHNICAL SOLUTIONS? HOW DO I INFORM MY CLIENTS OF MY SECURITY POLICIES? BUILDING CUSTOMER CONFIDENCE THROUGH DISCLOSURE SECURITY AS A SELLING POINT CHAPTER 5 IMPLEMENTING A SECURE E-COMMERCE WEB SITE INTRODUCTION TO E-COMMERCE SITE COMPONENTS IMPLEMENTING SECURITY ZONES INTRODUCING THE DEMILITARIZED ZONE MULTIPLE NEEDS EQUALS MULTIPLE ZONES PROBLEMS WITH MULTI-ZONE NETWORKS UNDERSTANDING FIREWALLS EXPLORING YOUR FIREWALL OPTIONS DESIGNING YOUR FIREWALL RULE SET IT STARTS WITH A “DENY ALL”ATTITUDE COMMON PORTS FOR COMMON COMMUNICATIONS CONVERTING PSEUDO-CODE TO FIREWALL RULES PROTOCOLS AND RISKS: MAKING GOOD DECISIONS HOW DO I KNOW WHERE TO PLACE MY COMPONENTS? PROFILING SYSTEMS BY RISK ESTABLISHING RISK CONTROL REQUIREMENTS CREATING SECURITY ZONES THROUGH REQUIREMENT GROUPING IMPLEMENTING INTRUSION DETECTION WHAT IS INTRUSION DETECTION? YOUR CHOICES IN INTRUSION DETECTION NETWORK-BASED IDS HOST-BASED IDS EXAMPLE OF A NETWORK-BASED IDS EXAMPLE OF A HOST-BASED IDS MANAGING AND MONITORING THE SYSTEMS WHAT KIND OF MANAGEMENT TASKS CAN I EXPECT TO PERFORM? WHAT KINDS OF MONITORING SHOULD I BE PERFORMING? BASIC SYSTEM MONITORING MONITORING YOUR SECURITY DEVICES LOG FILE MANAGEMENT SHOULD I DO IT MYSELF OR OUTSOURCE MY SITE? PROS AND CONS OF OUTSOURCING YOUR SITE CO-LOCATION: ONE POSSIBLE SOLUTION SELECTING AN OUTSOURCE PARTNER OR ASP CHAPTER 6 SECURING FINANCIAL TRANSACTIONS UNDERSTANDING INTERNET-BASED PAYMENT CARD SYSTEMS CREDIT, CHARGE, OR DEBIT CARDS:WHAT ARE THE DIFFERENCES? POINT-OF-SALE PROCESSING DIFFERENCES THAT CHARGE CARDS BRING INTO THE PICTURE CAPTURE AND SETTLEMENT STEPS IN AN INTERNET-BASED PAYMENT CARD TRANSACTION TOXIC DATA LIVES EVERYWHERE! APPROACHES TO PAYMENTS VIA THE INTERNET OPTIONS IN COMMERCIAL PAYMENT SOLUTIONS COMMERCE SERVER PROVIDERS BRAVING IN-HOUSE RESOURCES SECURE PAYMENT PROCESSING ENVIRONMENTS ADDITIONAL SERVER CONTROLS CONTROLS AT THE APPLICATION LAYER UNDERSTANDING CRYPTOGRAPHY METHODOLOGY SUBSTITUTION METHOD TRANSPOSITION METHOD TRANSPOSITION EXAMPLE THE ROLE OF KEYS IN CRYPTOSYSTEMS SYMMETRIC KEYS ASYMMETRIC KEYS PRINCIPLES OF CRYPTOGRAPHY UNDERSTANDING HASHING DIGESTING DATA DIGITAL CERTIFICATES EXAMINING E-COMMERCE CRYPTOGRAPHY HASHING FUNCTIONS BLOCK CIPHERS IMPLEMENTATIONS OF PPK CRYPTOGRAPHY THE SSL PROTOCOL TRANSPORT LAYER SECURITY (TLS) PRETTY GOOD PRIVACY (PGP) S/MIME SECURE ELECTRONIC TRANSACTIONS (SET) XML DIGITAL SIGNATURES VIRTUAL POS IMPLEMENTATION ICVERIFY ALTERNATIVE PAYMENT SYSTEMS SMART-CARD-BASED SOLUTIONS EMV MONDEX VISA CASH THE COMMON ELECTRONIC PURSE SPECIFICATION (CEPS) PROXY CARD PAYMENTS PAYPAL AMAZON PAYMENTS FUNNY MONEY BEENZ FLOOZ CHAPTER 7 HACKING YOUR OWN SITE ANTICIPATING VARIOUS TYPES OF ATTACKS DENIAL OF SERVICE ATTACKS INFORMATION LEAKAGE ATTACKS FILE ACCESS ATTACKS MISINFORMATION ATTACKS SPECIAL FILE/DATABASE ACCESS ATTACKS ELEVATION OF PRIVILEGES ATTACKS PERFORMING A RISK ANALYSIS ON YOUR SITE DETERMINING YOUR ASSETS WHY ATTACKERS MIGHT THREATEN YOUR SITE AND HOW TO FIND THEM TESTING YOUR OWN SITE FOR VULNERABILITIES DETERMINING THE TEST TECHNIQUE RESEARCHING YOUR VULNERABILITIES MAPPING OUT A WEB SERVER USING AUTOMATED SCANNING TOOLS HIRING A PENETRATION TESTING TEAM CHAPTER 8 DISASTER RECOVERY PLANNING: THE BEST DEFENSE WHAT IS DISASTER RECOVERY PLANNING? STRUCTURING A DISASTER RECOVERY PLAN LOSS OF DATA OR TRADE SECRETS LOSS OF ACCESS TO PHYSICAL SYSTEMS LOSS OF PERSONNEL OR CRITICAL SKILL SETS PRACTICING COMPLIANCE WITH QUALITY STANDARDS ENSURING SECURE INFORMATION BACKUP AND RESTORATION THE NEED FOR BACKUPS AND VERIFICATION AN EXAMPLE BACKUP ROTATION PROCESS STORAGE AREA NETWORKS PROTECTING BACKUPS OF SENSITIVE INFORMATION USER AUTHENTICATION DATA ENCRYPTION AND CONTROLS KEY MANAGEMENT PLANNING FOR HARDWARE FAILURE OR LOSS OF SERVICES THE SINGLE POINT OF FAILURE PROBLEM ISP REDUNDANCY NETWORK HARDWARE REDUNDANCY SYSTEM HARDWARE REDUNDANCY EXPANDING THE SCOPE OF YOUR SOLUTIONS HOW DO I PROTECT AGAINST NATURAL DISASTERS? HOT SITES:THE ALTERNATE PATH TO RECOVERY HOW DO I CHOOSE A HOT SITE? TESTING THE PROCESS UNDERSTANDING YOUR INSURANCE OPTIONS ERRORS AND OMISSIONS COVERAGE INTELLECTUAL PROPERTY LIABILITY FIRST PARTY E-COMMERCE PROTECTION DETERMINING THE COVERAGE YOU NEED FINANCIAL REQUIREMENTS THE DELICATE BALANCE: INSURANCE AND THE BOTTOM LINE COVERAGE THAT MAY NOT BE NEEDED CHAPTER 9 HANDLING LARGE VOLUMES OF NETWORK TRAFFIC WHAT IF MY SITES POPULARITY EXCEEDS MY EXPECTATIONS? DETERMINING THE LOAD ON YOUR SITE DETERMINING ROUTER LOAD DETERMINING SWITCH LOAD DETERMINING LOAD BALANCER LOAD DETERMINING WEB SERVER LOAD PERFORMANCE TUNING THE WEB SERVER HOW DO I MANAGE MY BANDWIDTH NEEDS? CONTRACTING FOR BANDWIDTH ESTIMATING REQUIRED SERVICE LEVELS HOW DO I KNOW WHEN I NEED MORE BANDWIDTH? OBTAINING BANDWIDTH ON DEMAND INTRODUCTION TO LOAD BALANCING WHAT IS LOAD BALANCING? CHANGING THE DESTINATION MAC ADDRESS MODIFYING THE IP ADDRESSES USING A PROXY SERVER FINDING A CUSTOM SOFTWARE/CLUSTERING SOLUTION DETERMINING LOAD THE PROS AND CONS OF LOAD BALANCING LOAD BALANCING AND SECURITY CHAPTER 10 INCIDENT RESPONSE, FORENSICS, AND THE LAW WHY IS AN INCIDENT RESPONSE POLICY IMPORTANT? PANIC OR BE CALM:YOU DECIDE HOW NOT TO HANDLE AN INCIDENT PROPER POLICY PAYS OFF INCIDENT RESPONSE POLICY RECAP ESTABLISHING AN INCIDENT RESPONSE TEAM SETTING THE PROSECUTION BOUNDARIES ATTACKERS CROSSING THE LINE UNDERSTANDING THE CHAIN OF CUSTODY ESTABLISHING AN INCIDENT RESPONSE PROCESS INTRODUCTION TO FORENSIC COMPUTING TRACKING INCIDENTS RESOURCES LEGAL/GOVERNMENT/LAW ENFORCEMENT BACKUP/FORENSICS INCIDENT TRACKING SYSTEMS MISCELLANEOUS