E-Payment gateways. Opportunities & Threats. Saleem Zoughbi
|
|
|
- Valentine Manning
- 10 years ago
- Views:
Transcription
1 E-Payment gateways Opportunities & Threats Saleem Zoughbi
2 2/18 Lexicon! e-payment The action of submitting a value of money from one source to another electronically e-payment Gateway The framework (including the operating process) through which the e-payment can be initiated e-payment Platform The tangible and non-tangible components that implements the gateway (HW, SW, application, etc.)
3 3/18 Lexicon! e-payment Environment The e-payment platform with the users, rules and specific protocols used Knowledge The aggregates of data, metadata and all related databases in any architecture (such as distributed, etc.) Regulator The actual decision-making and law enforcer body
4 Anatomy of e-payment Environments 4/18 Security level 1 Security level 2 Infrastructure: Hardware, Connectivity, Operating systems
5 5/18 Infrastructure Common to all e-service platforms Hardware: Servers Connectivity: Networking Operating Systems: (OS & NOS)
6 6/18 Anatomy of e-payment Systems Component Level Remark Suitable Knowledge 1 Core DBases Distributed Process Agents 2 e-government: Applied processes designed Legal Agents 3 e-governance and related legislation Transactions Management SOA e-signature 4 Maturity 4 Secure MIS
7 7/18 Security Levels Security level 1: (User level) Security level 2: (Transaction level) 1. Access, 2. Authentication 3. Presence 1. Permission, 2. Encoding 3. Verification Allowed to use, share and be present on the gateway Permitted to request a transaction and complete it
8 8/18 Gateway Entrance Risk Server (CERT oriented) Security Level 1 Server Security Level 2 Server
9 9/18 Typical 7 tiers of the e-payment Gateways 1. Bank: Pays and receives funds 2. Citizen: Initiates transaction and completes it 3. Company Receives transaction request and cooperate to enable Citizen to complete it
10 10/18 Typical 7 tiers of the e-payment Gateways 4. Monetary regulator : Issues credit cards Manage currency changes, etc. 5. Security Office: Authenticates users Permits or rejects access, processes, etc. 6. Legal Regulator: Provides rules and laws to protect user Provides a conflict resolution mechanism, etc. 7. Technical provider: Provides environment:(hardware & software & communications)
11 11/18 A 7-Tier complex Environment Bank Citizen (Payer) Company (Payee) Monetary Regulator e-payment Environment Legal regulator Security Office Technical Provider
12 12/18 Stages of e-payment 1 2 3
13 13/18 1. Entrance 2. Request Simple Log-in & Password Dynamic Password Encryption Secure log-in authentically (finger prints, etc.) Choice from menus Single Window as much as possible Process verification Submittal for confirmation History tracking
14 14/18 3- TRANSACT Security Office Monetary Regulator Legal regulator
15 15/18 Priority Issues Encryption & Encoding 1 Broadband specifications 2 Information protocol enforcement among stakeholders 3 Fraud counter measures 4 1. Dynamic, secure: cases: (classical examples: PGP / Viterbi) 2. Unified and minimum advocated, with access to all citizens (household or centers) 3. Standards of data specifications, and rules exchange and sharing: the W5: what, when, how, who and where 4. Laws and enforcement of laws to counter fraud and provide preventive measures Building Trust
16 16/18 Murphy's e-payment Laws Any e-payment gateway, when running, is obsolete. If an e-payment gateway is safe and useful, it is time to plan it to be changed. The sensitivity and security of data should force an ON- GOING process of enhancement the lifetime of an e- Payment gateway is shorter than other information systems: it is being hacked and attacked constantly, with increasing malicious intelligence!
17 17/18 A Concluding Question: Have you conducted in the last month a transaction on the net using credit cards? No Ye s
18 18/18 Issues for Future e-payments Personalized budgets automated in the bank.. Citizen is advised and questioned by the gateway real-time! ( cc: internal intelligence???). Value-added: Transparency and anti-corruption or violation of rights? Thank You
Introduction to Cyber Security / Information Security
Introduction to Cyber Security / Information Security Syllabus for Introduction to Cyber Security / Information Security program * for students of University of Pune is given below. The program will be
POLICIES TO MITIGATE CYBER RISK
POLICIES TO MITIGATE CYBER RISK http://www.tutorialspoint.com/information_security_cyber_law/policies_to_mitigate_cyber_risk.htm Copyright tutorialspoint.com This chapter takes you through the various
CHAPTER 4 DEPLOYMENT OF ESGC-PKC IN NON-COMMERCIAL E-COMMERCE APPLICATIONS
70 CHAPTER 4 DEPLOYMENT OF ESGC-PKC IN NON-COMMERCIAL E-COMMERCE APPLICATIONS 4.1 INTRODUCTION In this research work, a new enhanced SGC-PKC has been proposed for improving the electronic commerce and
Transaction Anomaly Protection Stopping Malware At The Door. White Paper
Transaction Anomaly Protection Stopping Malware At The Door White Paper Table of Contents Overview 3 Programmable Crime Logic Alter Web Application Flow & Content 3 Programmable Crime Logic Defeats Server-Side
Basics of Internet Security
Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational
Lecture 02b Cloud Computing II
Mobile Cloud Computing Lecture 02b Cloud Computing II 吳 秀 陽 Shiow-yang Wu T. Sridhar. Cloud Computing A Primer, Part 2: Infrastructure and Implementation Topics. The Internet Protocol Journal, Volume 12,
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
Cisco Advanced Services for Network Security
Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs
Information security controls. Briefing for clients on Experian information security controls
Information security controls Briefing for clients on Experian information security controls Introduction Security sits at the core of Experian s operations. The vast majority of modern organisations face
FREQUENTLY ASKED QUESTIONS
FREQUENTLY ASKED QUESTIONS Continuous Monitoring 1. What is continuous monitoring? Continuous monitoring is one of six steps in the Risk Management Framework (RMF) described in NIST Special Publication
Adi Armoni Tel-Aviv University, Israel. Abstract
Informing Science Data Security Volume 5 No 1, 2002 Data Security Management in Distributed Computer Systems Adi Armoni Tel-Aviv University, Israel [email protected] Abstract This research deals with
Chapter 6: Fundamental Cloud Security
Chapter 6: Fundamental Cloud Security Nora Almezeini MIS Department, CBA, KSU From Cloud Computing by Thomas Erl, Zaigham Mahmood, and Ricardo Puttini(ISBN: 0133387526) Copyright 2013 Arcitura Education,
Whitepaper on AuthShield Two Factor Authentication with ERP Applications
Whitepaper on AuthShield Two Factor Authentication with ERP Applications By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to account passwords... 4 2.1 Social Engineering or Password
ObserveIT User Activity Monitoring
KuppingerCole Report EXECUTIVE VIEW by Martin Kuppinger April 2015 ObserveIT provides a comprehensive solution for monitoring user activity across the enterprise. The product operates primarily based on
Information Technology Policy
Information Technology Policy Security Information and Event Management Policy ITP Number Effective Date ITP-SEC021 October 10, 2006 Category Supersedes Recommended Policy Contact Scheduled Review [email protected]
X-Road. egovernment interoperability framework
X-Road egovernment interoperability framework Serving e-nation over 10 years Backbone of the Estonian egovernment 12 years of active duty, no downtime Over 2000 connected e-services More than 900 connected
API Management: Powered by SOA Software Dedicated Cloud
Software Dedicated Cloud The Challenge Smartphones, mobility and the IoT are changing the way users consume digital information. They re changing the expectations and experience of customers interacting
Payment Card Industry Data Security Standard
Symantec Managed Security Services support for IT compliance Solution Overview: Symantec Managed Services Overviewview The (PCI DSS) was developed to facilitate the broad adoption of consistent data security
Government Service Bus
Government Service Bus The GSB (Government Service Bus) is intended to become the central platform of integration and services for the provision of government electronic services and transactions, and
McAfee Security Architectures for the Public Sector
White Paper McAfee Security Architectures for the Public Sector End-User Device Security Framework Table of Contents Business Value 3 Agility 3 Assurance 3 Cost reduction 4 Trust 4 Technology Value 4 Speed
White Paper for PDTnet Authorization and Security Concepts
Product Data Technology in a network: White Paper for PDTnet Authorization and Security Concepts Version: 1.0 Status: Final Resp. Author: Date: May 2003 Distribution: Public Oliver Guntermann, PROSTEP
Introduction to E-commerce
i Zheng Qin Introduction to E-commerce With 98 figures Springer Contents Part 1 Fundamentals 1 Fundamentals of E-commerce 3 1.1 The Origin and Development of E-commerce 4 1.1.1 The Origin and Development
Leveraging innovative security solutions for government. Helping to protect government IT infrastructure, meet compliance demands and reduce costs
IBM Global Technology Services Leveraging innovative security solutions for government. Helping to protect government IT infrastructure, meet compliance demands and reduce costs Achieving a secure government
ISO 27001 COMPLIANCE WITH OBSERVEIT
ISO 27001 COMPLIANCE WITH OBSERVEIT OVERVIEW ISO/IEC 27001 is a framework of policies and procedures that include all legal, physical and technical controls involved in an organization s information risk
PCI Compliance for Cloud Applications
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
Cloud Computing for E-Governance
IIIT, Hyderabad Cloud Computing for E-Governance A white paper Abstract The worldwide revolution in Internet is changing our lives in terms of the way we work, learn and interact. These changes naturally
Security & Privacy Issues in Mobile Cloud Computing
Security & Privacy Issues in Mobile Cloud Computing Manmohan Chaturvedi,1, Sapna Malik, Preeti Aggarwal and Shilpa Bahl Ansal University, Gurgaon- 122011, India 1 [email protected] Indian
With Great Power comes Great Responsibility: Managing Privileged Users
With Great Power comes Great Responsibility: Managing Privileged Users Darren Harmer Senior Systems Engineer Agenda What is a Privileged User Privileged User Why is it important? Security Intelligence
Protecting Official Records as Evidence in the Cloud Environment. Anne Thurston
Protecting Official Records as Evidence in the Cloud Environment Anne Thurston Introduction In a cloud computing environment, government records are held in virtual storage. A service provider looks after
Symantec VIP Integration with ISE
Symantec VIP Integration with ISE Table of Contents Overview... 3 Symantec VIP... 3 Cisco Identity Services Engine (ISE)... 3 Cisco Centralized Web Authentication... 4 VIP in Action... 4 ISE Configuration...
Chapter 1: Introduction
Chapter 1 Introduction 1 Chapter 1: Introduction 1.1 Inspiration Cloud Computing Inspired by the cloud computing characteristics like pay per use, rapid elasticity, scalable, on demand self service, secure
Cyber Security and Privacy
Cyber Security and Privacy Jovan Golić CySeP Winter School, Stockholm, 2014 EIT ICT Labs EIT ICT Labs is one of the first Knowledge and Innovation Communities set up in 2010 by the European Institute of
Securing Data on Microsoft SQL Server 2012
Securing Data on Microsoft SQL Server 2012 Course 55096 The goal of this two-day instructor-led course is to provide students with the database and SQL server security knowledge and skills necessary to
Whitepaper on AuthShield Two Factor Authentication and Access integration with Microsoft outlook using any Mail Exchange Servers
Whitepaper on AuthShield Two Factor Authentication and Access integration with Microsoft outlook using any Mail Exchange Servers By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to
SOLUTION BRIEF CA TECHNOLOGIES IDENTITY-CENTRIC SECURITY. How Can I Both Enable and Protect My Organization in the New Application Economy?
SOLUTION BRIEF CA TECHNOLOGIES IDENTITY-CENTRIC SECURITY How Can I Both Enable and Protect My Organization in the New Application Economy? CA Security solutions can help you enable and protect your business
APPLICATION OF MULTI-AGENT SYSTEMS FOR NETWORK AND INFORMATION PROTECTION
18-19 September 2014, BULGARIA 137 Proceedings of the International Conference on Information Technologies (InfoTech-2014) 18-19 September 2014, Bulgaria APPLICATION OF MULTI-AGENT SYSTEMS FOR NETWORK
Business ebanking Fraud Prevention Best Practices
Business ebanking Fraud Prevention Best Practices User ID and Password Guidelines Create a strong password with at least 8 characters that includes a combination of mixed case letters, numbers, and special
Threat Mitigation for VoIP
Threat Mitigation for VoIP Bogdan Materna, VP Engineering and CTO VoIPshield Systems Third Annual VoIP Security Workshop June 2, 2006 Overview Basics VoIP Security Impact Examples of real vulnerabilities
A brief on Two-Factor Authentication
Application Note A brief on Two-Factor Authentication Summary This document provides a technology brief on two-factor authentication and how it is used on Netgear SSL312, VPN Firewall, and other UTM products.
Security Center Unified Security Platform
Security Center Unified Security Platform License Plate Recognition Video Surveillance Access Control Innovative Solutions Simply Powerful. The Security Center is a unified security platform. It seamlessly
Certified E-commerce Consultant (CEC)
Certified E-commerce Consultant (CEC) Syllabus Copyright This is intellectual property of ACTA S.A. and it is protected by Greek and European legislation concerning copyright. The creation of a copy of
Enabling the SmartGrid through Cloud Computing
Enabling the SmartGrid through Cloud Computing April 2012 Creating Value, Delivering Results 2012 eglobaltech Incorporated. Tech, Inc. All rights reserved. 1 Overall Objective To deliver electricity from
How To Monitor Your Entire It Environment
Preparing for FISMA 2.0 and Continuous Monitoring Requirements Symantec's Continuous Monitoring Solution White Paper: Preparing for FISMA 2.0 and Continuous Monitoring Requirements Contents Introduction............................................................................................
MS-55096: Securing Data on Microsoft SQL Server 2012
MS-55096: Securing Data on Microsoft SQL Server 2012 Description The goal of this two-day instructor-led course is to provide students with the database and SQL server security knowledge and skills necessary
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
REGULATIONS FOR THE SECURITY OF INTERNET BANKING
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
Optimos Enterprise Helpdesk Automation Solution Case Study
Optimos Enterprise Helpdesk Automation Solution Case Study IT Help Central National Science Foundation Optimos Incorporated 4455 Brookfield Corporate Drive Chantilly, VA 20151 Telephone: (703) 488-6900
Unified Payment Platform Payment Pos Server Fraud Detection Server Reconciliation Server Autobill Server e-point Server Mobile Payment Server
Unified Payment Platform Payment Pos Server Detection Server Reconciliation Server Autobill Server e-point Server Mobile Payment Server Securing Payment & Beyond Infinitium E-Payment is a Unified Payment
Design of Database Security Policy In Enterprise Systems
Design of Database Security Policy In Enterprise Systems by Krishna R Singitam Database Architect Page 1 of 10 Table of Contents 1. Abstract... 3 2. Introduction... 3 2.1. Understanding the Necessity of
Active Directory LDAP
Whitepaper WPS Parking Solutions Hoevenweg 11 5652 AW EIndhoven T +31 (0)40 250 91 11, [email protected], www.wpsparkingsolutions.com T +31(0)40 250 91 11, E [email protected], W www.wpsparkingsolutions.com
Lecture 7: Privacy and Security in Mobile Computing. Cristian Borcea Department of Computer Science NJIT
Lecture 7: Privacy and Security in Mobile Computing Cristian Borcea Department of Computer Science NJIT Location Privacy Location Authentication Trusted Ad Hoc Networks 2 Privacy Violated Request: Retrieve
Provide access control with innovative solutions from IBM.
Security solutions To support your IT objectives Provide access control with innovative solutions from IBM. Highlights Help protect assets and information from unauthorized access and improve business
Protect the data that drives our customers business. Data Security. Imperva s mission is simple:
The Imperva Story Who We Are Imperva is the global leader in data security. Thousands of the world s leading businesses, government organizations, and service providers rely on Imperva solutions to prevent
Tableau Online Security in the Cloud
Tableau Online Security in the Cloud Author: Ellie Fields Senior Director, Product Marketing, Tableau Software June 2013 p2 Tableau Software understands that data is among the most strategic and important
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Proven LANDesk Solutions
LANDesk Solutions Descriptions Proven LANDesk Solutions IT departments face pressure to reduce costs, reduce risk, and increase productivity in the midst of growing IT complexity. More than 4,300 organizations
KASPERSKY FRAUD PREVENTION PLATFORM COVERING ONLINE AND MOBILE BANKING RISKS
KASPERSKY FRAUD PREVENTION PLATFORM COVERING ONLINE AND MOBILE BANKING RISKS ONLINE PAYMENTS ARE VERY POPULAR BUT NOT SECURE of people regularly use online banking, online shopping or 98% e-payment services
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS
NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS Scope and Applicability: These Network and Certificate System Security Requirements (Requirements) apply to all publicly trusted Certification Authorities
Data Security on the Move. Mark Bloemsma, Sr. Sales Engineer Websense
Data Security on the Move Mark Bloemsma, Sr. Sales Engineer Websense Consumerization of IT Fast & disruptive Enables business Increases productivity It s Mine! THE MOBILE ENTERPRISE. TYPES OF DEVICES METHODS
Securing e-government Web Portal Access Using Enhanced Two Factor Authentication
Securing e-government Web Portal Access Using Enhanced Two Factor Authentication Ahmed Arara 1, El-Bahlul Emhemed Fgee 2, and Hamdi Ahmed Jaber 3 Abstract This paper suggests an advanced two-factor authentication
Secure distribution of the device identity in mobile access network. Konstantin Shemyak senior security specialist, Nokia Siemens Networks
Secure distribution of the device identity in mobile access network Konstantin Shemyak senior security specialist, Nokia Siemens Networks 1 MobiSec-2010 Secure distribution of the device identity in mobile
Bellevue University Cybersecurity Programs & Courses
Undergraduate Course List Core Courses: CYBR 250 Introduction to Cyber Threats, Technologies and Security CIS 311 Network Security CIS 312 Securing Access Control CIS 411 Assessments and Audits CYBR 320
Integration using IBM Solutions
With special reference to integration with SAP XI Email: [email protected] Table of contents Integration using IBM Solutions Executive Summary...3 1. Introduction...4 2. IBM Business Integration
Syslog Analyzer ABOUT US. Member of the TeleManagement Forum. [email protected] +1-916-290-9300 http://www.ossera.com
Syslog Analyzer ABOUT US OSSera, Inc. is a global provider of Operational Support System (OSS) solutions for IT organizations, service planning, service operations, and network operations. OSSera's multithreaded
Internal audit of cybersecurity. Presentation to the Atlanta IIA Chapter January 2015
Internal audit of cybersecurity Presentation to the Atlanta IIA Chapter January 2015 Agenda Executive summary Why is this topic important? Cyber attacks: increasing complexity arket insights: What are
Information Security Services. Achieving PCI compliance with Dell SecureWorks security services
Information Security Services Achieving PCI compliance with Dell SecureWorks security services Executive summary In October 2010, the Payment Card Industry (PCI) issued the new Data Security Standard (DSS)
Securing enterprise collaboration through email and file sharing on a unified platform
Axway MailGate SC Securing enterprise collaboration through email and file sharing on a unified platform Email is the primary collaboration tool employees use to share information and send large files.
Governance, Risk & Compliance for Public Sector
Governance, Risk & Compliance for Public Sector Steve Hagner EMEA GRC Solution Sales From egovernment to Oracle igovernment Increase Efficiency and Transparency Oracle igovernment
WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales
WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales The Cost of Cybercrime Sony $171m PlayStation 3 data breach (April 2011) $3 trillion
OPC Unified Architecture - Connectivity Guide
OPC Unified Architecture - Connectivity Guide January, 2010 Ref. 01.02 Kepware Technologies Table of Contents 1. Overview... 1 2. Prerequisites... 1 3. Security... 2 3.1 Automatic... 2 3.2 Exchange...
IDaaS: Managed Credentials for Local & State Emergency Responders
IDaaS: Managed Credentials for Local & State Emergency Responders NextgenID ID*TRUST Platform NextgenID - Headquarters USA 10226 San Pedro, Suite 100 San Antonio, TX 78216 +1 (210) 530-9991 www.nextgenid.com
OPENIAM ACCESS MANAGER. Web Access Management made Easy
OPENIAM ACCESS MANAGER Web Access Management made Easy TABLE OF CONTENTS Introduction... 3 OpenIAM Access Manager Overview... 4 Access Gateway... 4 Authentication... 5 Authorization... 5 Role Based Access
Managed Security Services for Data
A v a y a G l o b a l S e r v i c e s Managed Security Services for Data P r o a c t i v e l y M a n a g i n g Y o u r N e t w o r k S e c u r i t y 2 4 x 7 x 3 6 5 IP Telephony Contact Centers Unified
The Imperative for High Assurance Credentials: State Identity Credential and Access Management (SICAM) Guidance and Roadmap
The Imperative for High Assurance Credentials: State Identity Credential and Access Management (SICAM) Guidance and Roadmap AAMVA Region I Conference E-ID, DLDV, and Privacy Conducting Business Securely
Datawire Secure Transport Value Proposition
Transport Value Proposition Contents: What is Transport? Transport is a patented connectivity service Datawire Defined that transports financial transactions securely and reliably over Datawire Value Proposition
SERVICES IN NGN NEXT GENERATION NETWORKS
Journal of Information, Control and Management Systems, Vol. 3, (2005), No. 2 97 SERVICES IN NGN NEXT GENERATION NETWORKS Alžbeta KANÁLIKOVÁ Faculty of Management and Informatics, University of Žilina,
Technical Proposition. Security
Technical Proposition ADAM Software NV The global provider of media workflow and marketing technology software ADAM Software NV adamsoftware.net [email protected] Why Read this Technical Proposition?
INFORMATION PROTECTED
INFORMATION PROTECTED Symantec Protection Suite Effective, comprehensive threat protection Safeguarding your organization s business-critical assets in today s ever-changing threat landscape has never
Securing the Cloud through Comprehensive Identity Management Solution
Securing the Cloud through Comprehensive Identity Management Solution Millie Mak Senior IT Specialist What is Cloud Computing? A user experience and a business model Cloud computing is an emerging style
NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT
NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT OVERVIEW The National Institute of Standards of Technology Framework for Improving Critical Infrastructure Cybersecurity (The NIST Framework) is a