IV. Step Four:
Secure Your Site
With your Internet identity
established and your site built and hosted, it's time to turn your
online storefront into a thriving e-commerce business. To do it, you
must win your customers' trust. Eighty-five percent of Web users
surveyed reported that a lack of security made them uncomfortable
sending credit card numbers over the Internet. E-merchants who can win
the confidence of these customers will gain their business and their
loyalty—and an enormous opportunity for grabbing market share and
expanding sales.
- The Risks of E-Commerce
In person-to-person transactions, security is based on physical
cues. Consumers accept the risks of using credit cards in places
like department stores because they can see and touch the
merchandise and make judgments about the store. On the Internet,
without those physical cues, it is much more difficult for customers
to assess the safety of your business. Also, serious security
threats have emerged:
- Spoofing—The low cost of Web site creation and the ease
of copying existing pages makes it all too easy to create
illegitimate sites that appear to be operated by established
organizations. Con artists have illegally obtained credit card
numbers by setting up professional-looking Web sites that mimic
legitimate businesses.
- Unauthorized disclosure—When purchasing information is
transmitted "in the clear," without proper security and
encryption, hackers can intercept the transmissions to obtain
customers' sensitive information—like credit card numbers.
- Unauthorized action—A competitor or disgruntled
customer can alter a Web site so that it malfunctions or refuses
service to potential clients.
- Eavesdropping—The private content of a transaction, if
unprotected, can be intercepted en route over the Internet.
- Data alteration—The content of a transaction can be not
only intercepted, but also altered en route, either maliciously or
accidentally. User names, credit card numbers, and dollar amounts
sent without proper security and encryption are all vulnerable to
such alteration.
To take advantage of the opportunities of e-commerce and avoid the
risks, you must find the answers to questions like:
"How can I be certain that my customers' credit card information
is protected from online eavesdroppers?"
"How can I reassure customers who come to my site that they are
doing business with me, not with a fake set up to steal their credit
card numbers?"
"Once I've found a way to authoritatively identify my business to
customers and protect private customer information on the Web,
what's the best way to let customers know about it, so that they can
confidently transact business with me?"
The process of addressing these general security questions boils
down to these goals:
- Authentication: Your customers must be able to assure
themselves that they are in fact doing business with you—not a
"spoof" site masquerading as you.
- Confidentiality: Sensitive information and transactions
on your Web site, such as the transmission of credit card
information, must be kept private and secure.
- Data integrity: Communication between you and your
customers must be protected from alteration by third parties in
transmission on the Internet.
- Proof of communication: A person must not be able to
deny that he or she sent a secured communication or made an online
purchase.
- The Trust Solution: SSL Server IDs for Authentication and
Encryption
Digital certificates for your Web site (or "Server IDs") are the
answer for these security questions. Installed on your Web server, a
Server ID is a digital credential that enables your customers to
verify your site's authenticity and to securely communicate with it.
Server IDs allow your e-business to provide customers with the
world's highest level of trust. A Server ID assures them that your
Web site is legitimate, that they are really doing business with
you, and that confidential information—such as credit card
numbers—transmitted to you online is protected.
- How Server IDs Work
Server IDs take advantage of the state-of-the-art Secure Sockets
Layer (SSL) protocol, developed by Netscape. SSL has become the
universal standard for authenticating Web sites to Web browser
users, and for encrypting communications between browser users and
Web servers. Because SSL is built into all major browsers and Web
servers, simply installing a digital certificate, or Server ID,
enables SSL capabilities.
SSL server authentication allows users to confirm a Web
server's identity. SSL-enabled client software, such as a Web
browser, can automatically check that a server's certificate and
public ID are valid and have been issued by a certificate authority
(CA)—such as VeriSign—listed in the client software's list of
trusted CAs. SSL server authentication is vital for secure
e-commerce transactions in which, for example, users send credit
card numbers over the Web and first want to verify the receiving
server's identity.
An encrypted SSL connection requires that all information
sent between a client and a server to be encrypted by the sending
software and decrypted by the receiving software, protecting private
information from interception over the Internet. In addition, all
data sent over an encrypted SSL connection is protected with a
mechanism for detecting tampering—that is, for automatically
determining whether the data has been altered in transit. This means
that users can confidently send private data, such as credit card
numbers, to a Web site, trusting that SSL keeps it private and
confidential.
The Server ID process works as follows:
- A customer contacts your site and accesses a page secured by a
Server ID (indicated by a URL that begins with "https:" instead of
just "http:" or by a message from the browser).
- Your server responds, automatically sending the customer your
site's digital certificate, which authenticates your site.
- Your customer's Web browser generates a unique "session key"
to encrypt all communications with the site. The user's browser
encrypts the session key itself with your site's public key so
only your site can read the session key.
- A secure session is now established. It all takes only seconds
and requires no action by the customer. Depending on the browser,
the customer may see a key icon becoming whole or a padlock
closing, indicating that the session is secure.
SSL Server IDs come in two strengths: 40-bit and 128-bit (the
numbers refer to the length of the "session key" generated for each
encrypted transaction). The longer the key, the more difficult it is
to break the encryption code. 128-bit SSL encryption is the world's
strongest: according to RSA Labs, it would take a trillion years to
crack a 128-bit session key using today's technology. The primary
difference between the two types of VeriSign Server IDs is the
strength of the SSL session that each enables. Microsoft and
Netscape offer two versions of their Web browsers, export and
domestic, that enable different levels of encryption depending on
the type of Server ID with which the browser is communicating.
- The Seal is designed for display on your Web site as a symbol
of security and trust, encouraging your customers to confidently
provide credit card numbers and other sensitive information. The
Secure Site Seal is sent automatically to the technical contact
that you specify during the Secure Site or Commerce Site
enrollment and purchasing process, 24 hours after the Server ID is
issued.
When the Seal is posted on your Web site's home page,
security/privacy policy page, or credit card transaction pages,
you can connect it to your Server ID. When your customers click on
the Seal, they instantly see a pop-up screen of information about
the Server ID, assuring them that transactions with your site are
encrypted by SSL, and allowing them to verify your site's identity
and check the ID status in real time.
- Code Signing IDs
If your e-commerce site offers downloadable software, content, or
code, you can digitally "shrink-wrap" it so customers can be
confident that it hasn't been altered or corrupted in transmission.
All you need is a special code-signing digital certificate, or
Digital ID.
- E-Mail IDs
Installed in your Web browser or e-mail software, an e-mail digital
certificate, or Digital ID, serves as your online passport, allowing
you to digitally sign e-mail messages. Your e-mail Digital ID
assures recipients that messages really came from you, and also
allow you to encrypt messages, using your recipient's Digital ID, so
only your recipient can decrypt and read your messages. Installing
and using e-mail Digital IDs is easy with virtually all Web browsers
and e-mail programs.
- Your Privacy and Security Statement
A vital component of every e-commerce Web site is a comprehensive
security and privacy statement that describes exactly how your
business secures information and uses it.
|
|
