The purpose we create this E-Commerce blog is actually to raise the awareness of everyone in E-Commerce.
We will be updating the latest development on E-Commerce to blog anytime.
Showing posts with label week 4 - Online security. Show all posts
Showing posts with label week 4 - Online security. Show all posts
Identity theft: Case on stolen laptop, hacking and lost CD
What a “Wow” for the various methods of Identity Theft but not for Windows Vista! I really do not realize that there are so many unbelievable identity theft cases. Some of the cases are not just stealing individual or organization security data but act with violence.
Due to the widespread of information technology, a password-protection is not sufficient to be a fundamental defense to secure your data. Individual or organization should adopt password encryption rather than a usual password.
Why do I say so? Let’s take an example on Windows XP operating system platform. If you place a user password before the Windows start, it is equivalent to zero when a terrorist entering your system in Safe Mode. Even thought you place a password in CMOS, there is still “solution” to break into your system.
Password encryption is recommended but cost you a lot. You might need expertise to monitor the encryption process because this is a coded-based password protection.
Regarding to the question - How safe exactly is our data?
My answer is NOT SAFE AT ALL!
Read more about Internet Security from My E-Commerce blog.
Personal Experience:
A real life case: My girl friend applied for Single Line Phone from a Company. Her name – Lee Sze Chii. Due to the typo error made by the staff, she registered the service with company as Lee Sze Chil. She only realized this matter when receiving the first bill… One day, she received a call from telemarketer, who addressed her as Lee Sze Chil, subsequently told her that you won a prize for XDaysXNights vacation to France for two person.
This is very obvious that Company is selling our personal data to other companies to gain extra earning which is unethical.
While the Internet plays more and more important role for improving business nowadays, it is not a very secure medium to do business without the proper security measures. Since internet security is critical for all businesses that are connected to the Internet, it can be explained why the application of third party certification has become more popular.
Third party certification is an assessment carried out by an independent, third party organization that is qualified and licensed to issue certification when the assessment is successfully completed. Third party refers to certification authority who has been invited to verify a company’s product or service does indeed comply with the industry standards.
One of the certification authorities in Malaysia is MSC Trustgate.com Sdn. Bhd. which established in 1999. They offer complete security solutions and leading trust services which includes digital certificates, digital signatures, encryption and decryption. Their products and services include SSL Certificate, Managed PKI, Personal ID, MyTRUST, MyKAD ID, SSL VPN, Managed Security Services, VeriSign Certified Training and Application Development. MSC Trustgate’s services fall into the high-end solutions category, packed with various security and value added features.
VeriSign is the leading Secure Sockets Layer (SSL) Certificate Authority enabling secure e-commerce, communications, and interactions for Web sites, intranets, and extranets.
How it works?
It assigns a digital signature to a customer that contains two encrypted codes called keys—a private key and a public key. The private key certifies the customer while the public key certifies the customer to anyone using the customer’s web site. These codes form what is called a “secure socket layer”, or SSL that insures the web site’s authenticity. The public key allows users to encrypt their transactions using SSL technology while the private key allows authorized users of the web site to receive information sent using the public key. This assures consumers that their transaction is secure.
The concern is about phishing scams and online fraud that continue to erode confidence in e-commerce, causing customers to abandon online transactions. To gain customer confidence, the application of SSL is needed to protect transactional data by a layered approach in order to security at all points vulnerable to attack.
How the Trust Signs restore customer confidence? The closed padlock and “https” in the URL address can show whether a web page is secure. In the latest high security browsers, there is a green address bar when a highly authenticated Extended Validation certificate is detected. To guard against imposters and phishing sites, Web site visitors have also learned to look for authenticated information about the certificate owner from a trust mark such as the VeriSign Secured® Seal or in the high security address bar.
In addition, the application of third party certification across business assets provides comprehensive protection for the consumer, brand, and network. VeriSign security experts help balance risk, cost and user experience to apply the most effective security approach to the business.
Nowadays, computer users are facing the threats of cybercrime, phishing, internet and network attacks such as computer viruses, worms and Trojan horses.
Cyber-criminals--target specific demographics, geographical locations or precise people and businesses, and they are attracted to anywhere that holds potential access to personal information, including login credentials, account details and credit card information.
Phishing-- is an older form of cyber-crime that involves tricking a consumer into providing personal data information directly to a hacker through an unsecured Web site or redirected link.
Internet and network attack that jeopardize security include virus, worm, and Trojan horse.
-Virus is a piece of code that is secretly introduced into a system in order to corrupt it or destroy data. Virus attack can damage the operating system, causing the loss of data and other possible losses.
-A worm is a program that copies itself repeatedly. The repeatedly copied files use up the available space and slow down a computer operating speed.
-A Trojan horse is a program that hides within or looks like a legitimate program. Although they seem to be harmless, they may however be triggered if certain condition is certified.
Those internet security threats will try to steal your information from your computer through the internet. It's very danger if our computer online without any internet security system such as anti-virus. For example, Trojans will track into your computer and steal your personal information such as password of your e-banking account, email account and etc.
But there is still some prevention that we can do to prevent internet threat.
1. Limit connectivity. Limit downloads
2. Avoid clicking on links from e-mails hawking products
3. Use only authorized media for loading data and software
4. Have the up-to-date Anti-virus
5. Always remember to scan your computer with Anti-virus
6. Delete all the cookies in the computer to prevent track on the history/password.
7. On your firewall to prevent hackers
Phishing is a type of deception designed to steal your valuable personal data, such as credit card numbers, Windows Live ID, other account data and passwords, or other information. Recent victims include Charlotte’s Bank of America, Best Buy and eBay, where people are directed to Web pages that looked identical to the companies’ sites.
Example of Phishing: The more complex a web browser or e-mail client is, the more loopholes and weaknesses phishers can find. This means that phishers add to their bags of tricks as programs get more sophisticated.
I. Phishing e-mails will contain some of these common elements: (view screen capture above from Eudora)
1. The "From Field" appears to be from the legitimate company mentioned in the e-mail.
2. The e-mail will usually contain logos or images that have been taken from the Web site of the company mentioned in the scam e-mail.
3. The e-mail will contain a clickable link with text suggesting you use the inserted link to validate your information. Note that the hyperlink does NOT point to the legitimate Citibank Web site URL.
In this instance, the text you click is "here. However, this may also state something like "Log-in to Citibank" or "www.citibank.com/secure" to be even more misleading. This clickable area is only text and can be changed to anything the sender wants it to read.
II. The following is another example of what a phishing scam in an e-mail message might look like.
To make these phishing e-mail messages look even more legitimate, the scam artists may place a link in them that appears to go to the legitimate Web site (1), but actually takes you to a phony scam site (2) or possibly a pop-up window that looks exactly like the official site.
III. Graphics. By determining which e-mail client and browser the victim is using, the phisher can place images of address bars and security padlocks over the real status and address bars.
IV. Popup windows and frames. Malicious popup windows can appear over the site, or invisible frames around it can contain malicious code.
V. HTML. Some phishing e-mails look like plain text but really include HTML markup containing invisible words and instructions that help the message bypass anti-spam software.
VI. DNS cache poisoning. Also called pharming, this is when a phisher (often by speaking to customer service representatives) changes DNS server information. This causes everyone trying to reach the spoofed company's web site to be directed to another site.
Prevention Methods with OS and Applications supports: - Keep your operating system up to date, and install up-to-date antivirus and antispyware software. This will be the first level of defense against phishing scams.
- Windows Defender, which comes with Windows Vista to help prevent spyware or other unwanted software.
- Internet Explorer 7 (IE7) is available for Windows Vista and has a Phishing Filter built in that scans and alerts users to phishing sites.
Self-Prevention Methods: - Do not reply to email or pop-up messages that ask for personal or financial information, and do not click on links in the message.
- Do not cut and paste a link from the message into your Web browser – phishers can make links look like they go one place, but that actually send you to a different site.
- Businesses should not ask you to send passwords, login names, Social Security numbers, or other personal information through e-mail. E.g.: If you receive an e-mail message from Microsoft asking you to update your credit card information – DO NOT RESPOND! This is a phishing scam.
- Certain self-awareness should be implied. “You have won the lottery.” The lottery scam is a common phishing scam known as advanced fee fraud. The message will claim that you have won a large sum of money, this is actually a trickster. There is no Microsoft lottery or Citibank lottery.
Personal Opinion: What are the differences between Fishing and Phishing? Both actions are waiting for opportunity to gain advantage from third parties. However, phishing is more complicated, dangerous and harass repeatedly to Internet users. Anywhere, we should be able to differentiate whether the e-mail we received is reliable and trustfulness or not. Sufficient awareness must be obtain to prevent PHISHING!
In 21st century, computer and internet have become part of the life of human. Nowadays, people around the world are relying on computer and internet to mange their personal finances data and store sensitive personal data such as banking, taxes, online bill payment etc. this lead to the increasing of cyber criminal. This includes getting people’s personal and financial data to commit identity theft, by stealing electronic data or could be stealing information from trash.
.
These days, protecting your personal and financial data is very important, to ensure that you don’t become victim of cyber criminal. How to safeguard your personal and financial data? Here are a number of tips that can be use to protect your data. There are following:
1) Password protection.
When you create password, don’t use the obvious password such as your birth dates, telephone number or identity card number. This will ensure that the password is strong enough to protect your access to data. Besides that, also never carry passwords in your wallet, to avoid your identity being stolen by others.
2) Install and maintain an anti-virus and firewall for your computer.
Through browsing of internet, your computer may have a risk of attack by viruses and Trojan that may steal or modify the data on your own computer. By install anti-virus software and firewall will protect yourself against viruses and leave you lees vulnerable.
3) Make sure your virus software and firewalls are up to date.
Also, make sure your virus software and firewalls are up to date. Set the virus software to an auto update mode so that you don't have to worry about staying current. In addition to automatic virus checking, load an anti-spyware program on your computer, scan your computer regularly but make sure that it comes from a legitimate company. There are some firms that are placing spyware on your computer and then selling you software to remover the spyware.
4) Limit the physical access and transportation of your data.
Whenever possible, store your personal and financial data on devices that are physically safe and only allow authorized people access to those devices. In addition, don’t allow your personal and financial data to be sent via email or over the phone.
5) Shared important financial information.
Use a cross cut shredder to shred your important financial information before placing it in the trash or recycling bin. This will prevent your information being stolen by others. Shred such information as credit card receipts, credit card offers, bank statements, paycheck stubs, tax information etc.
6) Account monitoring.
You can protect your identity by regularly monitoring your accounts for any unauthorized activity, such as review your monthly statement frequently or you also can go online to look at the recent activity.
6) Account monitoring.
You can protect your identity by regularly monitoring your accounts for any unauthorized activity, such as review your monthly statement frequently or you also can go online to look at the recent activity.
You can learn more technique to safeguard your personal and financial data, by click on following links:
