Secure Electronic Transaction

One prominent application that requires strong security is electronic payment on the internet. When making internet-based credit card purchases, users want to know that their credit card information is protected, while the merchant wants assurance that the person making the purchase cannot later refute the transaction.

Secure electronic transaction (SET) is an open specification for handling credit card transactions over a network, with emphasis on the Web and Internet. Secure transactions are critical for electronic commerce (e-commerce) on the Internet.

A SET purchase involves three parties of the cardholder, the merchant and the card issuer. The cardholder shares the order information with the merchant. The merchant shares payment information with the card issuer.

SET provides confidentiality of payment and order information. Payment information cannot be viewed by the merchant; only by the payment authorization of processing entities.

Merchants must automatically and safely collect and process payments from internet clients; therefore, a secure protocol is required to support the activities of the credit card companies.

SET is designed to secure credit card transactions by authenticating cardholders, merchants, and banks by preserving the confidentiality of payment data.

The SET specification is administered by an organization known as Secure Electronic Transaction LLC (SETCo) formed by Visa and MasterCard, and allows parties to a transaction to confirm each other identity. The initial specifications provided a complex security protocol using RSA for the public-key components.

SET is widely used because:
*Customer needs to install secure software wallet on PC that contains their private key
*The transaction verification process is slower than SSL
*Trader also needs to use special SET software on their server
Secure Electronic Transaction

Wiretapping and electronic eavesdropping

Electronic eavesdropping utilizes electronic devices to covertly listen to conversation, whereas wiretapping is the traditional term for interception of telephone conversations. The word is no longer restricted to communications travelling by wire and contemporary wiretaps are more commonly placed on radio links or inside telephone office.

At common law, eavesdropping was considered a nuisance. ‘Eavesdropping’ as William Blackstone defined it, meant to listen under walls or window, or the eaves of house, to hearken after discourse, and thereupon to frame slanderous and mischievous tales’.

Before the advent of electronic communication, people could easily avoid eavesdroppers by ensuring that nobody else was around during their conversations.

Eavesdropping and wiretapping can both legal and illegal. When legal, it is carried out by authority of a warrant issued in accord with the law.

The advent of electronic communications was soon flowed by the invention of recording and transmitting devices that enabled new and more sophisticated forms of eavesdropping than overhearing a conversation with naked ear.

Electronic eavesdropping technology is highly developed to the point where countermeasures have not kept up with the art of bugging.
Wiretapping and electronic eavesdropping

Magnetic ink character recognition (MICR) reader

Magnetic ink contains a special metal powder with magnetic properties. When this ink issued to write or print text on paper, the texts are human readable or can be read special device called the magnetic ink character recognition (MICR) reader, which also reproduces the characters into the computer.

The reading speed of MICR is faster than OCR. Magnetic ink readers are largely used in banks to read from a cheque, the cheque number, the bank number, the branch number and the customer’s account number.

MICR characters, such as those located on the bottom of  a check that represent the bank routing number, check number and account number are inscribed on checks with magnetic ink when the checks are first printed.

MICR text uses a unique typeface, which gives it a distinct appearance that is readily recognizable by eye. The characters can still be read by the computer even after being overwritten with ordinary ink or handle with dirty hands.

Smaller units of MICR are used by many businesses to deposit paper checks remotely. To make a remote deposit using an MICR reader the check is scanned and then the check data is transmitted to the bank electronically for payment.

There are also MICR readers incorporated in most new ATM machines today to enable the MICR information located on checks inserted into the ATM machine to be read at the time of the deposit.

The advantages of magnetic ink character recognition include: accuracy, difficult to forge, can be read easily and speed or reading.
Magnetic ink character recognition (MICR) reader

Electronic Funds Transfer

A computerized cash payments system that transfers funds without use of checks, currency or other paper documents is called electronic funds transfer.

The systems are a major form of electronic payment systems in banking and retailing industries.

It consists of a group of technologies that allow financial transactions to be carried out electronically.

Electronic funds transfer systems use a variety of information technologies to capture and process money and credit transfers between banks and businesses and their customers.

The most common methods of electronic funds transfer are automated teller machines, paycheck direct deposits/withdrawals, pay-by-phone systems, and point of sale terminals.

For example, banking networks support teller terminals at all banks offices and automated teller machines (ATMs) at location throughout the world. This machine operated automatically providing receipt and disbursement of cash loan payments, balance information and other functions.

Banks may also support pay-by-phone and Web-based bill payment services, which enable bank customers to use their telephones or networked PCs to electronically pay bills.

In addition, most point of sale terminals in retail stores are networked to bank EFT systems. This makes it possible for customer to use a credit card or debit card to instantly pay for gas, groceries, or other purchase at participating outlets.

To control cash payments through electronic funds transfer, the person responsible for requesting transfer should be given a password. That bank should not accept electronic funds transfer requests from any person unable to provide an established password.
Electronic Funds Transfer

E-Government

E-Government
In the commercial sphere, business to business (B2B), business to consumer (B2C) and business to employee (BTE) electronic business has come widely accepted.

Government are also embracing the internet to provide services to business (G2B) and citizens (C2C), as well as government to government (G2G), citizen to citizen (C2C), government to supplier (G2S) and government to employee (G2E).

In year 2000 European Union Summit in Lisbon set ambitious goal of making Europe the world most competitive and dynamic knowledge based economy. It resulted in the eEurope Action plan to exploit the full potential of the Internet to promote a competitive economy. The objective is to make it easier to deal with local, regional and national governments by making services available electronically.

The benefits of e Government are reduced costs through more efficient processes, the integration of disparate agencies systems, and improved service to citizens via the internet and other electronic channels.

Investment by government will also decrease the cost of doing business through simplification of procedures self-service systems and one stop shop for enterprises. The biggest beneficiaries here will be the small to medium enterprises, which are the backbone of the European economy.
E-Government

Secure Electronic Payments

The explosion of Internet and World Wide Web is rapidly changing the way the business transactions are carried out. It is emerging as a medium through which the goods and services are being provided to the customer. This medium is being used to serve the customers at faster rated and at lower cost.

It is also being used to provide the better quality of service. Most business transactions involve the payment and settlement process. Electronic payment systems have become necessary to enable the Internet commerce. The requirements of payment transactions include confidentiality, security, integrity, non-repudiation and authentication. One of the main bottlenecks in the growth of E-commerce is lack of suitable payment instrument and corresponding electronic payment system.

When you make an online purchase on the internet, your credit card information is vulnerable to interception by network sniffers. Software that easily recognizes credit card number formats. Several basic security measures are being used to solve the security problems:

• Encrypt (code and scramble) the data passing between the customer and merchant
• Encrypt the data passing between customer and the company authorizing the credit card transaction
• or Take sensitive information offline

For example many companies use the Secure Socket Layer (SSL) security method developed by Netscape Communications that automatically encrypts data passing between your Web browser and a merchant’s server.

However, sensitive information is still venerable to misuse once it’s decrypted (decoded and unscramble) and stored in a merchant’s server. So a digital wallet approach such as the CyberCash payment was developed. In this method, you add security software add-on modules to your Web browse: That enables your browser to encrypt your credit card data in such a way that only the bank that authorizes credit card transactions for the merchant gets to see it. All the merchants is told is whether your credit card transaction is approved or not.

The Secure Electronic Transaction or SET, standard for electronic payment security extends the CyberCash digital wallet approach. In this method, EC software encrypts a digits envelop of digital certificates specifying the payments details for each transaction. SET (Secure Electronic Transaction) has been agreed to by VISA, MasterCard, IBM, Microsoft Network, Netscape and most other industry player.

Therefore, SET is expected to eventually become dominant standard for secure electronic payments in the internet. However, SET has been stalled by the reluctant of companies to incur its increased hardware, software and cost requirement.
Secure Electronic Payments

To ensure business trust

The global economy is a digital economy, which depends on business fundamentals. At any given time, one of these fundamental is to establish trust. We have to make sure we are taking measures that infuse trust in our business partners, our employees, our consumers – and in the market.

Security and privacy are the enablers of trust in today’s economy. Effective security cannot be accomplished though technology alone: it is a process.

Collaboration and business continuity issues have therefore especially relevant: mission critical business functions, technology and business risks as well as risk mitigation and recovery strategies have to be identified.

Digitization by electronically capturing and storing records and data in secure, remote locations, creating stable systems and putting business continuity plans in place.

Business, as well as local, regional and national governments around the world need to increasingly turn to information technology – to digitization – to create more efficient and more secure processes to response to the new security challenges we are facing.

In addition, legal certainty is essential to establish trust. We must look to standardize out law and punishments for information technology crimes. Existing legislation needs to be reviewed to ensure that e-crimes can be prosecuted effectively. The current laws vary from country to country and the punishments often do not fit the crime.

It is essential that legal framework to combat cyber crime focus at international solutions that are balanced, flexible and meet broad international compatibility.

Furthermore, if not carefully considered, new laws can also have unintended damaging effects and government solution should take into account the expertise and adequate involvement of industry.

Action needs to be taken to both prevent criminal activity by enhancing security, but also to ensure that law enforcement authorities have the appropriate means to act if the prevention fails. However, the primary objective of computer and network security is to reduce risk, not to catch criminals.

To ensure business trust