E-Commerce and Cyber Security
E-Commerce and Cyber Security tests business models, online payment flow, and the threats and safeguards that protect transactions. Expect transaction classification, attack identification and selection of the correct control.
Core rules and concepts
- E-commerce models: B2B (business to business), B2C (business to consumer), C2C (consumer to consumer, such as classifieds), B2G (business to government).
- A payment gateway authorizes and transfers payment between merchant, acquirer and card network; it does not manage inventory.
- Threats: phishing (fraudulent messages that harvest credentials), malware, ransomware, denial-of-service, man-in-the-middle, identity theft.
- Safeguards: strong passwords and 2FA, HTTPS/TLS encryption in transit, firewall, antivirus, regular patches, digital signatures and certificates.
- Authentication proves who you are; authorization decides what you may access.
- Encryption is reversible with a key; hashing is one-way and is used for integrity and password storage.
Worked example
A customer receives an email claiming to be from a bank, asking them to click a link and re-enter their PIN 'to avoid account closure'. The link goes to a lookalike domain. Identify the attack and two controls. The pressure tactic, credential request and mismatched domain indicate phishing. Controls: do not use the link, but type the bank's address directly or use the official app; enable two-factor authentication so a stolen PIN alone is insufficient. A firewall on the bank's network would not protect the customer's credentials.
Traps that cost marks
- Calling any online purchase B2B; a consumer buying from a shop is B2C.
- Confusing authentication with authorization.
- Saying a firewall removes viruses; it filters traffic, while antivirus scans files.
- Treating hashing as encryption that can be reversed.
- Believing HTTPS makes a fraudulent site trustworthy; certificates can be obtained for lookalike domains.