E-Payment gateways. Opportunities & Threats. Saleem Zoughbi



Similar documents
Introduction to Cyber Security / Information Security

POLICIES TO MITIGATE CYBER RISK

CHAPTER 4 DEPLOYMENT OF ESGC-PKC IN NON-COMMERCIAL E-COMMERCE APPLICATIONS

Transaction Anomaly Protection Stopping Malware At The Door. White Paper

Basics of Internet Security

Lecture 02b Cloud Computing II

Using Foundstone CookieDigger to Analyze Web Session Management

Cisco Advanced Services for Network Security

Information security controls. Briefing for clients on Experian information security controls

FREQUENTLY ASKED QUESTIONS

Adi Armoni Tel-Aviv University, Israel. Abstract

Chapter 6: Fundamental Cloud Security

Whitepaper on AuthShield Two Factor Authentication with ERP Applications

ObserveIT User Activity Monitoring

Information Technology Policy

X-Road. egovernment interoperability framework

API Management: Powered by SOA Software Dedicated Cloud

Payment Card Industry Data Security Standard

Government Service Bus

McAfee Security Architectures for the Public Sector

White Paper for PDTnet Authorization and Security Concepts

Introduction to E-commerce

Leveraging innovative security solutions for government. Helping to protect government IT infrastructure, meet compliance demands and reduce costs

ISO COMPLIANCE WITH OBSERVEIT

PCI Compliance for Cloud Applications

Cloud Computing for E-Governance

Security & Privacy Issues in Mobile Cloud Computing

With Great Power comes Great Responsibility: Managing Privileged Users

Protecting Official Records as Evidence in the Cloud Environment. Anne Thurston

Symantec VIP Integration with ISE

Chapter 1: Introduction

Cyber Security and Privacy

Securing Data on Microsoft SQL Server 2012

Whitepaper on AuthShield Two Factor Authentication and Access integration with Microsoft outlook using any Mail Exchange Servers

SOLUTION BRIEF CA TECHNOLOGIES IDENTITY-CENTRIC SECURITY. How Can I Both Enable and Protect My Organization in the New Application Economy?

APPLICATION OF MULTI-AGENT SYSTEMS FOR NETWORK AND INFORMATION PROTECTION

Business ebanking Fraud Prevention Best Practices

Threat Mitigation for VoIP

A brief on Two-Factor Authentication

Security Center Unified Security Platform

Certified E-commerce Consultant (CEC)

Enabling the SmartGrid through Cloud Computing

How To Monitor Your Entire It Environment

MS-55096: Securing Data on Microsoft SQL Server 2012

North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing

REGULATIONS FOR THE SECURITY OF INTERNET BANKING

Optimos Enterprise Helpdesk Automation Solution Case Study

Unified Payment Platform Payment Pos Server Fraud Detection Server Reconciliation Server Autobill Server e-point Server Mobile Payment Server

Design of Database Security Policy In Enterprise Systems

Active Directory LDAP

Lecture 7: Privacy and Security in Mobile Computing. Cristian Borcea Department of Computer Science NJIT

Provide access control with innovative solutions from IBM.

Protect the data that drives our customers business. Data Security. Imperva s mission is simple:

Tableau Online Security in the Cloud

Larry Wilson Version 1.0 November, University Cyber-security Program Critical Asset Mapping

Proven LANDesk Solutions

KASPERSKY FRAUD PREVENTION PLATFORM COVERING ONLINE AND MOBILE BANKING RISKS

Passing PCI Compliance How to Address the Application Security Mandates

NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS

Data Security on the Move. Mark Bloemsma, Sr. Sales Engineer Websense

Securing e-government Web Portal Access Using Enhanced Two Factor Authentication

Secure distribution of the device identity in mobile access network. Konstantin Shemyak senior security specialist, Nokia Siemens Networks

Bellevue University Cybersecurity Programs & Courses

Integration using IBM Solutions

Syslog Analyzer ABOUT US. Member of the TeleManagement Forum

Internal audit of cybersecurity. Presentation to the Atlanta IIA Chapter January 2015

Information Security Services. Achieving PCI compliance with Dell SecureWorks security services

Securing enterprise collaboration through and file sharing on a unified platform

Governance, Risk & Compliance for Public Sector

WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales

OPC Unified Architecture - Connectivity Guide

IDaaS: Managed Credentials for Local & State Emergency Responders

OPENIAM ACCESS MANAGER. Web Access Management made Easy

Managed Security Services for Data

The Imperative for High Assurance Credentials: State Identity Credential and Access Management (SICAM) Guidance and Roadmap

Datawire Secure Transport Value Proposition

SERVICES IN NGN NEXT GENERATION NETWORKS

Technical Proposition. Security

INFORMATION PROTECTED

Securing the Cloud through Comprehensive Identity Management Solution

NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT

Transcription:

E-Payment gateways Opportunities & Threats Saleem Zoughbi

2/18 Lexicon! e-payment The action of submitting a value of money from one source to another electronically e-payment Gateway The framework (including the operating process) through which the e-payment can be initiated e-payment Platform The tangible and non-tangible components that implements the gateway (HW, SW, application, etc.)

3/18 Lexicon! e-payment Environment The e-payment platform with the users, rules and specific protocols used Knowledge The aggregates of data, metadata and all related databases in any architecture (such as distributed, etc.) Regulator The actual decision-making and law enforcer body

Anatomy of e-payment Environments 4/18 Security level 1 Security level 2 Infrastructure: Hardware, Connectivity, Operating systems

5/18 Infrastructure Common to all e-service platforms Hardware: Servers Connectivity: Networking Operating Systems: (OS & NOS)

6/18 Anatomy of e-payment Systems Component Level Remark Suitable Knowledge 1 Core DBases Distributed Process Agents 2 e-government: Applied processes designed Legal Agents 3 e-governance and related legislation Transactions Management SOA e-signature 4 Maturity 4 Secure MIS

7/18 Security Levels Security level 1: (User level) Security level 2: (Transaction level) 1. Access, 2. Authentication 3. Presence 1. Permission, 2. Encoding 3. Verification Allowed to use, share and be present on the gateway Permitted to request a transaction and complete it

8/18 Gateway Entrance Risk Server (CERT oriented) Security Level 1 Server Security Level 2 Server

9/18 Typical 7 tiers of the e-payment Gateways 1. Bank: Pays and receives funds 2. Citizen: Initiates transaction and completes it 3. Company Receives transaction request and cooperate to enable Citizen to complete it

10/18 Typical 7 tiers of the e-payment Gateways 4. Monetary regulator : Issues credit cards Manage currency changes, etc. 5. Security Office: Authenticates users Permits or rejects access, processes, etc. 6. Legal Regulator: Provides rules and laws to protect user Provides a conflict resolution mechanism, etc. 7. Technical provider: Provides environment:(hardware & software & communications)

11/18 A 7-Tier complex Environment Bank Citizen (Payer) Company (Payee) Monetary Regulator e-payment Environment Legal regulator Security Office Technical Provider

12/18 Stages of e-payment 1 2 3

13/18 1. Entrance 2. Request Simple Log-in & Password Dynamic Password Encryption Secure log-in authentically (finger prints, etc.) Choice from menus Single Window as much as possible Process verification Submittal for confirmation History tracking

14/18 3- TRANSACT Security Office Monetary Regulator Legal regulator

15/18 Priority Issues Encryption & Encoding 1 Broadband specifications 2 Information protocol enforcement among stakeholders 3 Fraud counter measures 4 1. Dynamic, secure: cases: (classical examples: PGP / Viterbi) 2. Unified and minimum advocated, with access to all citizens (household or centers) 3. Standards of data specifications, and rules exchange and sharing: the W5: what, when, how, who and where 4. Laws and enforcement of laws to counter fraud and provide preventive measures Building Trust

16/18 Murphy's e-payment Laws Any e-payment gateway, when running, is obsolete. If an e-payment gateway is safe and useful, it is time to plan it to be changed. The sensitivity and security of data should force an ON- GOING process of enhancement the lifetime of an e- Payment gateway is shorter than other information systems: it is being hacked and attacked constantly, with increasing malicious intelligence!

17/18 A Concluding Question: Have you conducted in the last month a transaction on the net using credit cards? No Ye s

18/18 Issues for Future e-payments Personalized budgets automated in the bank.. Citizen is advised and questioned by the gateway real-time! ( cc: internal intelligence???). Value-added: Transparency and anti-corruption or violation of rights? Thank You