1.Give a description in your own words of the ACID properties of a transaction.
Transaction is a set of operations which are executed sequentially in order to transform data from one consistent state to another one. The four important properties of a transaction are atomicity, consistency, isolation and durability.
Atomicity is a transaction property which guarantee that both a transaction itself and all its operations are atomic. This means that either all operations, which are part of the transaction, must be completely carried out or not carried out at all. So if one operation fails, the whole transaction fails.
Consistency ensures that data is always in a constistent state. For example, a transaction of money transfer between two parties A and B happenned, if money is transfered from account A to account B, the transaction must substract the same amout from account A that is added to account B.
Isolation means that although transactions can be executed concurrently, a transaction is not interfered by other transactions and the transactions appear to run serially.
Durability means that the results of a sucessful transaction are stored in permanent storage so that the results can not be affected because of subsequent failures (e.g. power cut, network disconnects).
2.Describe a TP monitor environment. How can a TP monitor stop an operating system being overwhelmed?
Ince (2004) defined that "a Trasaction Processing (TP) monitor is a complex computer program which manages the execution of a transaction starting with the client executing the transaction; it will normally employ a number of server and then return any results to the client". The two important jobs of a TP monitor are: first, it manages the execution of the threads and processes of the transaction and second it ensures the ACID properties of the transaction are enforced.
There are a number of functions which can be carried out by TP monitors. For example CICS monitor of IBM can initialize, schedlue and destroy threads to control transactions,manage resources are being accessed, enable services to be subcontracted to other servers for a better transaction processing ("Transaction Processing Monitors", 2004).
A large number of concurrent clients would overwhelm an operating system and cause a server's down. A TP monitor maintains a pool of processes and queues transactions so that they take turns using the pool. If system is running a lot of small jobs that require few resources, a TP monitor can add processes; but if system is running a big job that require more resources, a TP monitor shuts down some process in order to free the resources (Jianghui, 2005) . Hence, a TP monitor is balancing the system resources, meanwhile, it prevents overwhelming an OS.
References
Jianghui, L.(2005). TP Monitors. Retrieved on 10 May 2009 from http://web.njit.edu/~gblank/cis604/Lectures/604TPMonitor.ppt
Ince, D. (2004). Developing distributed and e-commerce applications (2nd Ed.), Harlow, Essex, UK: Addison – Wesley
Transaction Processing Monitors.(2004). Viewed 12 May 2010 from http://publib.boulder.ibm.com/infocenter/txformp/v5r1/index.jsp?topic=/com.ibm.txseries510.doc/atshak0014.htm
Tuesday, May 25, 2010
Exercise 10: Concurrency and Threading demonstration in Python
1. Find definitions for eight terms and concepts used in threaded programming:
a.Thread Synchronisation
Thread synchronization requires that a running thread gain a "lock" on an object before it can access it. The thread will wait in line for another thread that is using the method/data member to be done with it. This is very important to prevent the corruption of program data if multiple threads will be accessing the same data. If two threads try to change a variable or execute the same method at the same, this can cause serious and difficult to find problems. Thread synchronization helps prevent this ("What is Thread Synchronisation?", n.d.)
b.Locks
Lock is a fundamental synchronization mechanism for enforcing limits on access to a resource in a shared environment where there are many threads of execution. Locks are one way of enforcing concurrency control policies (Lundh, 2007).
c.DeadLock
Dictionary Wikipedia (n.d.) defines: "deadlock refers to a specific condition when two or more processes are each waiting for each other to release a resource, or more than two processes are waiting for resources in a circular chain" ("DeadLock", 2010).
d.Semaphores
A semaphore is a data structure that is useful for solving a variety of synchronization problems. It is typical used to limit accesses to a resource with limited capacity. A semaphore has an internal counter rather than a lock flag, and it only blocks if more than a given number of threads have attempted to hold the semaphore. The counter is incremented when the semaphore is acquired and decremented when the semaphore is released. If the counter equals zero when the semaphore is acquired, the acquiring thread will be blocked(Downey, 2008).
e.Mutex (mutual exclusion)
According to Wikipedia (2010), Mutual Exclusion (often abbreviated to mutex) algorithms are used in concurrent programming to avoid the simultaneous use of a common resource, such as a global variable, by pieces of computer code called critical sections. A critical section is a piece of code in which a process or thread accesses a common resource. The critical section by itself is not a mechanism or algorithm for mutual exclusion. A program, process, or thread can have the critical section in it without any mechanism or algorithm which implements mutual exclusion ("Mutual Exclusion", 2010).
f.Thread
Ince(2004) defined “A thread is an execution of a chunk of code which can be carried out in parallel with the execution of other chunks of code”.
g.Event
An event, in a computing context, is any identifiable occurrence that has significance for system hardware or software. User-generated events include keystrokes and mouse clicks, among a wide variety of other possibilities. System-generated events include program loading and errors, also among a wide variety of other possibilities. An event typically represents some message, token, count, pattern, value, or marker that can be recognized within an ongoing stream of monitored inputs, such as network traffic, specific error conditions or signals, thresholds crossed, counts accumulated, and so on. ("What Is an Event", 2007)
h.Waitable timer.
According to msdn library(n.d.), a waitable timer object is a synchronization object whose state is set to signaled when the specified due time arrives. There are two types of waitable timers that can be created: manual-reset and synchronization. A timer of either type can also be a periodic timer.
2.A simple demonstration of the threading module in Python (threaddemo.py) that uses both a lock and semaphore to control concurrency is by Ted Herman at the University of Iowa. The code and sample output below are worth a look. Report your findings.
The program initializes 10 threads in which each threat is give a random delay time, but only allows three of them to be running at a time. Only when one of these three jobs is completed, one of the waiting threads is allowed to start. The program is ended when all the 10 threads are finished.
In order to control the limitation of running threads to be 3, the program employ a function called "BoundedSemaphore([Value])" of the "local" class. This is a factory function that returns a new bounded semaphore object. A bounded semaphore checks to make sure its current value doesn't exceed its initial value. If it does, ValueError is raised. In most situations semaphores are used to guard resources with limited capacity. If the semaphore is released too many times it's a sign of a bug. If not given, value defaults to 1. ("Python Library Reference", 2008).
# create a semaphore bounded up to 3
sema = threading.BoundedSemaphore(value=3)
Besides the program uses funtion Rlock() to enable only one of the three threads update variable "running" at a time using "acquire() and release()" mechanism. RLock( ) is a factory function that returns a new reentrant lock object. A reentrant lock must be released by the thread that acquired it. Once a thread has acquired a reentrant lock, the same thread may acquire it again without blocking; the thread must release it once for each time it has acquired it. ("Python Library Reference", 2009)
# create a Read Lock
mutex = threading.RLock()
mutex.acquire()
running = running + 1
mutex.release()
Refereces
Downey, A. B.(2008).The Little Book of Semaphores(2nd E.d.). Retrieved 13 May 2010 from http://www.greenteapress.com/semaphores/downey08semaphores.pdf
"DeadLock".(2010). Viewed 17 May 2010 from http://en.wikipedia.org/wiki/Deadlock
Lock(computer science).(n.d.)viewed 13 May 2010 from http://en.wikipedia.org/wiki/Lock_%28computer_science%29
Lundh, F. 2007.Thread Synchronization Mechanisms in Python.Viewed 13 May 2010 from http://effbot.org/zone/thread-synchronization.htm
"Mutual Exclusion".(2010). Viewed 17 May 2010 from http://en.wikipedia.org/wiki/Mutual_exclusion
msdn Library(n.d.).Waitable Timer Object.viewed 13 May 2010 from http://msdn.microsoft.com/en-us/library/ms687012(VS.85).aspx
"Python Library Reference".(2008).Viewed 05 May 2010 from http://www.python.org/doc/2.5.2/lib/module-threading.html
"What Is an Event".(2007).Viewed 12 May 2010 from http://searchsoa.techtarget.com/sDefinition/0,,sid26_gci1274431,00.html
"What is Thread Synchronisation?". (n.d.).Viewed 10 May 2010 from http://wiki.answers.com/Q/What_is_Thread_Synchronization
a.Thread Synchronisation
Thread synchronization requires that a running thread gain a "lock" on an object before it can access it. The thread will wait in line for another thread that is using the method/data member to be done with it. This is very important to prevent the corruption of program data if multiple threads will be accessing the same data. If two threads try to change a variable or execute the same method at the same, this can cause serious and difficult to find problems. Thread synchronization helps prevent this ("What is Thread Synchronisation?", n.d.)
b.Locks
Lock is a fundamental synchronization mechanism for enforcing limits on access to a resource in a shared environment where there are many threads of execution. Locks are one way of enforcing concurrency control policies (Lundh, 2007).
c.DeadLock
Dictionary Wikipedia (n.d.) defines: "deadlock refers to a specific condition when two or more processes are each waiting for each other to release a resource, or more than two processes are waiting for resources in a circular chain" ("DeadLock", 2010).
d.Semaphores
A semaphore is a data structure that is useful for solving a variety of synchronization problems. It is typical used to limit accesses to a resource with limited capacity. A semaphore has an internal counter rather than a lock flag, and it only blocks if more than a given number of threads have attempted to hold the semaphore. The counter is incremented when the semaphore is acquired and decremented when the semaphore is released. If the counter equals zero when the semaphore is acquired, the acquiring thread will be blocked(Downey, 2008).
e.Mutex (mutual exclusion)
According to Wikipedia (2010), Mutual Exclusion (often abbreviated to mutex) algorithms are used in concurrent programming to avoid the simultaneous use of a common resource, such as a global variable, by pieces of computer code called critical sections. A critical section is a piece of code in which a process or thread accesses a common resource. The critical section by itself is not a mechanism or algorithm for mutual exclusion. A program, process, or thread can have the critical section in it without any mechanism or algorithm which implements mutual exclusion ("Mutual Exclusion", 2010).
f.Thread
Ince(2004) defined “A thread is an execution of a chunk of code which can be carried out in parallel with the execution of other chunks of code”.
g.Event
An event, in a computing context, is any identifiable occurrence that has significance for system hardware or software. User-generated events include keystrokes and mouse clicks, among a wide variety of other possibilities. System-generated events include program loading and errors, also among a wide variety of other possibilities. An event typically represents some message, token, count, pattern, value, or marker that can be recognized within an ongoing stream of monitored inputs, such as network traffic, specific error conditions or signals, thresholds crossed, counts accumulated, and so on. ("What Is an Event", 2007)
h.Waitable timer.
According to msdn library(n.d.), a waitable timer object is a synchronization object whose state is set to signaled when the specified due time arrives. There are two types of waitable timers that can be created: manual-reset and synchronization. A timer of either type can also be a periodic timer.
2.A simple demonstration of the threading module in Python (threaddemo.py) that uses both a lock and semaphore to control concurrency is by Ted Herman at the University of Iowa. The code and sample output below are worth a look. Report your findings.
The program initializes 10 threads in which each threat is give a random delay time, but only allows three of them to be running at a time. Only when one of these three jobs is completed, one of the waiting threads is allowed to start. The program is ended when all the 10 threads are finished.
In order to control the limitation of running threads to be 3, the program employ a function called "BoundedSemaphore([Value])" of the "local" class. This is a factory function that returns a new bounded semaphore object. A bounded semaphore checks to make sure its current value doesn't exceed its initial value. If it does, ValueError is raised. In most situations semaphores are used to guard resources with limited capacity. If the semaphore is released too many times it's a sign of a bug. If not given, value defaults to 1. ("Python Library Reference", 2008).
# create a semaphore bounded up to 3
sema = threading.BoundedSemaphore(value=3)
Besides the program uses funtion Rlock() to enable only one of the three threads update variable "running" at a time using "acquire() and release()" mechanism. RLock( ) is a factory function that returns a new reentrant lock object. A reentrant lock must be released by the thread that acquired it. Once a thread has acquired a reentrant lock, the same thread may acquire it again without blocking; the thread must release it once for each time it has acquired it. ("Python Library Reference", 2009)
# create a Read Lock
mutex = threading.RLock()
mutex.acquire()
running = running + 1
mutex.release()
Refereces
Downey, A. B.(2008).The Little Book of Semaphores(2nd E.d.). Retrieved 13 May 2010 from http://www.greenteapress.com/semaphores/downey08semaphores.pdf
"DeadLock".(2010). Viewed 17 May 2010 from http://en.wikipedia.org/wiki/Deadlock
Lock(computer science).(n.d.)viewed 13 May 2010 from http://en.wikipedia.org/wiki/Lock_%28computer_science%29
Lundh, F. 2007.Thread Synchronization Mechanisms in Python.Viewed 13 May 2010 from http://effbot.org/zone/thread-synchronization.htm
"Mutual Exclusion".(2010). Viewed 17 May 2010 from http://en.wikipedia.org/wiki/Mutual_exclusion
msdn Library(n.d.).Waitable Timer Object.viewed 13 May 2010 from http://msdn.microsoft.com/en-us/library/ms687012(VS.85).aspx
"Python Library Reference".(2008).Viewed 05 May 2010 from http://www.python.org/doc/2.5.2/lib/module-threading.html
"What Is an Event".(2007).Viewed 12 May 2010 from http://searchsoa.techtarget.com/sDefinition/0,,sid26_gci1274431,00.html
"What is Thread Synchronisation?". (n.d.).Viewed 10 May 2010 from http://wiki.answers.com/Q/What_is_Thread_Synchronization
Excersise 9 : Electronic payments and Security
1. Find out about SET and the use of RSA 128-bit encryption for e-commerce.
Secure Electronic Transaction (SET) is a standard specification for protection of credit card transactions in open networks (e.g. Internet). It was started 1996 by two big credit card providers who are Master card and Visa card and then others companies participated in. It is not a payment method, but a set of protocols that allows users to employ existing credit card payment infrastructure in a secure fashion (Stallings, 2002).
RSA is a public key cryptography system which is invented in 1977 by three MIT professors. it can be used for digital signing, signature verification ("RSA Algorithm", n.d) and sending data over an insecure channel (Ince, 2004).
2. What can you find out about network and host-based intrusion detection systems?
Most intrusion detection system (IDS) were used to either detect or defelect attackes and there were two approaches in developing IDSs. IDSs help a system recognising that it is being attacked based on attack signatures and specific patterns. While network IDS looks for patterns of the network traffic to realize attacks, host-based IDS will scan log files for attack signatures. Both of them has strengths and weaknesses, so it is better to use both of them in developing an effective IDS ("Network- vs. Host-based Intrusion Detection: A Guide to Intrusion Detection Technology", 1998).
3. What is 'phishing'?
Webopedia(2010) states that :"The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information".
4. What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?
Ince (2004) said “SET is a protocol which is used for sending credit card information over the internet”. In one transaction there are three parties which are buyer, seller and the bank involved. When a purchase is made, the buy sent his credit card details which are encrypted using the private key to the seller. The seller’s server then attaches its digital signature and submits that bunch of data (encrypted credit-card details of buyer and seller’s digital signature) to the bank’s computer. This computer will validate the credit card and send receipts to both the buyer and the seller. Therefore the seller cannot access the buyer’s credit-card information and the bank does not care what customer bought . One major advantage of SET technology is eliminating large numbers of fraud transactions related to credit cards (Ince, 2004).
Secure Socket Layer(SSL),based on cryptography, is the most popular technology used in e-commerce security(Ince, 2004). SSL ensure that a trusted channel has been established before a transaction occurred between server and client. First SSL server allows the client to confirm the identity of the server by validating the server’s digital signature. Although client authentication is not use in common, the server can validate client in a similar way of the client validate the server as well. SSL uses different symmetric encryption techniques to exchange data between server and client (Ince, 2004).
Although SET is more secured to the customer than SSL because the merchant cannot access customer’s credit card details, SSL is more popular because it is simpler. In order to make a purchase only two parties are involved (buyer and seller), unlike SET requires three ( buyer, seller and the bank ).
5. What are cookies and how are they used to improve security? Can the use of cookies be a security risk?
Cookie or browser cookie is a text file stored by the client’s web browser. It is used for authentication, session tracking (state maintenance), store site preferences, shopping cart contents etc.
Data stored in the cookies is encrypted for information privacy and data security purpose ("HTTP cookie", 2010). When a client makes Http requests to a server, it is usually required that the cookies stored on the client to be sent with the Http request so that the server could determined this client is authenticated to access the server's resources.
Cookies are not executable files therefore they cannot replicate themselves and are not considered as viruses. However, Cookies can be use as spyware because they can track people (anti-spyware alerts). Based on cookies, hackers can build a user’s preferences. This action violate the privacy of users("HTTP cookie", 2010).
6. What makes a firewall a good security investment? Accessing the Internet, find two or three firewall vendors. Do they provide hardware, software or both?
A Firewall is an extra layer of protection which surrounds a network or an application. A firewall could be a hardware device or software application which is placed between your network and the Internet. It is able to filter both incoming and outcomming mesages(Ince, 2004). Therefore, a firewall can prevent un-authorised users to access your private network.
Having your network protected by a firewall is a good security investment in order to protect your network from hackers or viruses.
A firewall vendor can provide both hardware and software firewall (e.g. Cisco) or hardware firewall (e.g. Netgear) only. There are also plenty of vendor who provide firewall software only such as SunSoft, Netguard...
7. What measures should e-commerce provide to create trust among their potential customers? What measures can be verified by the customer?
One of the most difficult things of e-commerce websites is to create trust among their customers. Becasue of customer's worry in losing their personal information and financial details(e.g credit card details), an imporant factor in building trust, with both customers and partners, is the assurance that the e-commerce operation meets the demanding security standards required of organizations handling sensitive financial information. Ince(2004) suggests a series of requirements for secure e-commrece:
i) Authentication
This means that customers are able to ensure that they are in fact doing business and sending private information with a real identity.
ii) Confidentiality
Information such as credit card and transaction details, which are stored on a system or tranfered on the Internet. must be not accessed by unauthorised parties.
iii) Data integrity
Only authorised parties are able to change data and data cannot be tampered when transmit on the Internet.
iv) Nonrepudiation
Both the sender and receiver of a transaction can not deny that a transaction did not occur
Digital certificate, email confirmation, and online enquiry could help customers to verify that the security measure are taken in an e-commerce environment.
8. Get the latest PGP information from http://en.wikipedia.org/wiki/Pretty_Good_Privacy.
According to Wikipedia(2010), "Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was created by Philip Zimmermann in 1991".
The use of digital certificates and passports are just two examples of many tools for validating legitimate users and avoiding consequences such as identity theft. What others exist?
Other tools can be used for validating legitimate users are USB smart cards, smart cards, one time password, PKI authentication etc. These tools can be used together to create a strong authentication.
Reference
"HTTP cookie".(2010).viewed 12 May 2010 from http://en.wikipedia.org/wiki/HTTP_cookie
"Network- vs. Host-based Intrusion Detection: A Guide to Intrusion Detection Technology".(1998).Retreived 08 May 2010 from http://documents.iss.net/whitepapers/nvh_ids.pdf
Ince, D. (2004). Developing distributed and e-commerce applications (2nd Ed.), Harlow, Essex, UK: Addison – Wesley
"Pretty Good Privacy".(2010). Viewed 12 May 2010 from http://en.wikipedia.org/wiki/Pretty_Good_Privacy
"RSA Algorithm".(n.d).viewd 12 May 2010 from http://www.di-mgt.com.au/rsa_alg.html
Stallings, W.(2002).Introduction to Secure Electronic Transaction (SET).
viewed 12 May 2010 from http://www.informit.com/articles/article.aspx?p=26857
"Understanding and Using Firewalls".(2004). Viewed 08 May 2010 from http://www.bleepingcomputer.com/tutorials/tutorial60.html
Webopedia.(2010)."All about Phising".Viewed 09 May 20101 from http://www.webopedia.com/DidYouKnow/Internet/2005/phishing.asp
Wang, M.(2003).Assessment of E-Service Quality via E- Satisfaction in E-commerce Globalization. Retrieved 09 May 2010 from http://www.ejisdc.org/ojs2/index.php/ejisdc/article/viewFile/68/68
Zirkle, L.(2008).Intrusion Detection FAQ: What is host-based intrusion detection?. Viewed 05 May 2010 from http://www.sans.org/security-resources/idfaq/host_based.php
Secure Electronic Transaction (SET) is a standard specification for protection of credit card transactions in open networks (e.g. Internet). It was started 1996 by two big credit card providers who are Master card and Visa card and then others companies participated in. It is not a payment method, but a set of protocols that allows users to employ existing credit card payment infrastructure in a secure fashion (Stallings, 2002).
RSA is a public key cryptography system which is invented in 1977 by three MIT professors. it can be used for digital signing, signature verification ("RSA Algorithm", n.d) and sending data over an insecure channel (Ince, 2004).
2. What can you find out about network and host-based intrusion detection systems?
Most intrusion detection system (IDS) were used to either detect or defelect attackes and there were two approaches in developing IDSs. IDSs help a system recognising that it is being attacked based on attack signatures and specific patterns. While network IDS looks for patterns of the network traffic to realize attacks, host-based IDS will scan log files for attack signatures. Both of them has strengths and weaknesses, so it is better to use both of them in developing an effective IDS ("Network- vs. Host-based Intrusion Detection: A Guide to Intrusion Detection Technology", 1998).
3. What is 'phishing'?
Webopedia(2010) states that :"The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information".
4. What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?
Ince (2004) said “SET is a protocol which is used for sending credit card information over the internet”. In one transaction there are three parties which are buyer, seller and the bank involved. When a purchase is made, the buy sent his credit card details which are encrypted using the private key to the seller. The seller’s server then attaches its digital signature and submits that bunch of data (encrypted credit-card details of buyer and seller’s digital signature) to the bank’s computer. This computer will validate the credit card and send receipts to both the buyer and the seller. Therefore the seller cannot access the buyer’s credit-card information and the bank does not care what customer bought . One major advantage of SET technology is eliminating large numbers of fraud transactions related to credit cards (Ince, 2004).
Secure Socket Layer(SSL),based on cryptography, is the most popular technology used in e-commerce security(Ince, 2004). SSL ensure that a trusted channel has been established before a transaction occurred between server and client. First SSL server allows the client to confirm the identity of the server by validating the server’s digital signature. Although client authentication is not use in common, the server can validate client in a similar way of the client validate the server as well. SSL uses different symmetric encryption techniques to exchange data between server and client (Ince, 2004).
Although SET is more secured to the customer than SSL because the merchant cannot access customer’s credit card details, SSL is more popular because it is simpler. In order to make a purchase only two parties are involved (buyer and seller), unlike SET requires three ( buyer, seller and the bank ).
5. What are cookies and how are they used to improve security? Can the use of cookies be a security risk?
Cookie or browser cookie is a text file stored by the client’s web browser. It is used for authentication, session tracking (state maintenance), store site preferences, shopping cart contents etc.
Data stored in the cookies is encrypted for information privacy and data security purpose ("HTTP cookie", 2010). When a client makes Http requests to a server, it is usually required that the cookies stored on the client to be sent with the Http request so that the server could determined this client is authenticated to access the server's resources.
Cookies are not executable files therefore they cannot replicate themselves and are not considered as viruses. However, Cookies can be use as spyware because they can track people (anti-spyware alerts). Based on cookies, hackers can build a user’s preferences. This action violate the privacy of users("HTTP cookie", 2010).
6. What makes a firewall a good security investment? Accessing the Internet, find two or three firewall vendors. Do they provide hardware, software or both?
A Firewall is an extra layer of protection which surrounds a network or an application. A firewall could be a hardware device or software application which is placed between your network and the Internet. It is able to filter both incoming and outcomming mesages(Ince, 2004). Therefore, a firewall can prevent un-authorised users to access your private network.
Having your network protected by a firewall is a good security investment in order to protect your network from hackers or viruses.
A firewall vendor can provide both hardware and software firewall (e.g. Cisco) or hardware firewall (e.g. Netgear) only. There are also plenty of vendor who provide firewall software only such as SunSoft, Netguard...
7. What measures should e-commerce provide to create trust among their potential customers? What measures can be verified by the customer?
One of the most difficult things of e-commerce websites is to create trust among their customers. Becasue of customer's worry in losing their personal information and financial details(e.g credit card details), an imporant factor in building trust, with both customers and partners, is the assurance that the e-commerce operation meets the demanding security standards required of organizations handling sensitive financial information. Ince(2004) suggests a series of requirements for secure e-commrece:
i) Authentication
This means that customers are able to ensure that they are in fact doing business and sending private information with a real identity.
ii) Confidentiality
Information such as credit card and transaction details, which are stored on a system or tranfered on the Internet. must be not accessed by unauthorised parties.
iii) Data integrity
Only authorised parties are able to change data and data cannot be tampered when transmit on the Internet.
iv) Nonrepudiation
Both the sender and receiver of a transaction can not deny that a transaction did not occur
Digital certificate, email confirmation, and online enquiry could help customers to verify that the security measure are taken in an e-commerce environment.
8. Get the latest PGP information from http://en.wikipedia.org/wiki/Pretty_Good_Privacy.
According to Wikipedia(2010), "Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was created by Philip Zimmermann in 1991".
The use of digital certificates and passports are just two examples of many tools for validating legitimate users and avoiding consequences such as identity theft. What others exist?
Other tools can be used for validating legitimate users are USB smart cards, smart cards, one time password, PKI authentication etc. These tools can be used together to create a strong authentication.
Reference
"HTTP cookie".(2010).viewed 12 May 2010 from http://en.wikipedia.org/wiki/HTTP_cookie
"Network- vs. Host-based Intrusion Detection: A Guide to Intrusion Detection Technology".(1998).Retreived 08 May 2010 from http://documents.iss.net/whitepapers/nvh_ids.pdf
Ince, D. (2004). Developing distributed and e-commerce applications (2nd Ed.), Harlow, Essex, UK: Addison – Wesley
"Pretty Good Privacy".(2010). Viewed 12 May 2010 from http://en.wikipedia.org/wiki/Pretty_Good_Privacy
"RSA Algorithm".(n.d).viewd 12 May 2010 from http://www.di-mgt.com.au/rsa_alg.html
Stallings, W.(2002).Introduction to Secure Electronic Transaction (SET).
viewed 12 May 2010 from http://www.informit.com/articles/article.aspx?p=26857
"Understanding and Using Firewalls".(2004). Viewed 08 May 2010 from http://www.bleepingcomputer.com/tutorials/tutorial60.html
Webopedia.(2010)."All about Phising".Viewed 09 May 20101 from http://www.webopedia.com/DidYouKnow/Internet/2005/phishing.asp
Wang, M.(2003).Assessment of E-Service Quality via E- Satisfaction in E-commerce Globalization. Retrieved 09 May 2010 from http://www.ejisdc.org/ojs2/index.php/ejisdc/article/viewFile/68/68
Zirkle, L.(2008).Intrusion Detection FAQ: What is host-based intrusion detection?. Viewed 05 May 2010 from http://www.sans.org/security-resources/idfaq/host_based.php
Friday, April 16, 2010
Exercise 6
1. Design The form
2. Write the script
2.1 Python
Step 1: Create a following html file with name html_python.html
.jpg)
Step 2:Create a python file name python.py (match with the name in html form)
.jpg)
Line 1: Specify the location of python.exe
Line 2: Import cgi
Line 4: Define main()
Line 5: Inform the browsers that the information is the text
Line 6: Declare a variable
Line 7-10: If condition to identify whether form "firstname" is null or not. If not null the information will be display, otherwise, the error will display.
Step 3:Press submit button and it is a result
.jpg)
3. Can you modify the script to process the form
Python
Step 1: Create a python file name python_mod.py with the following code
Step 2: Modify html file with this code :form method="post" action="/cgi-bin/python_mod.py"
Step 3: Input the information and press submit. This is the result
4. Improve the user experience by add a Javascript feature
Use JavaScript to confirm you want to submit it or not by code: input type="submit" value="Submit" onclick="return confirm('Are you sure you want to submit?')"
and To validate the field. For example, the field name can not be null.
By insert this code:
function validateName()
{
var str=form1.name.value;
if(str.length==0)
{
alert("The name cannot be empty");
return false;
}
return true;
}
and modify this code in the form1: input name="name" type="text" onBlur="validateName()"
2. Write the script
2.1 Python
Step 1: Create a following html file with name html_python.html
.jpg)
Step 2:Create a python file name python.py (match with the name in html form)
.jpg)
Line 1: Specify the location of python.exe
Line 2: Import cgi
Line 4: Define main()
Line 5: Inform the browsers that the information is the text
Line 6: Declare a variable
Line 7-10: If condition to identify whether form "firstname" is null or not. If not null the information will be display, otherwise, the error will display.
Step 3:Press submit button and it is a result
.jpg)
3. Can you modify the script to process the form
Python
Step 1: Create a python file name python_mod.py with the following code
Step 2: Modify html file with this code :form method="post" action="/cgi-bin/python_mod.py"
Step 3: Input the information and press submit. This is the result
4. Improve the user experience by add a Javascript feature
Use JavaScript to confirm you want to submit it or not by code: input type="submit" value="Submit" onclick="return confirm('Are you sure you want to submit?')"
and To validate the field. For example, the field name can not be null.
By insert this code:
function validateName()
{
var str=form1.name.value;
if(str.length==0)
{
alert("The name cannot be empty");
return false;
}
return true;
}
and modify this code in the form1: input name="name" type="text" onBlur="validateName()"
Exercise 8
Create an XML document for an online catalogue of cars where each car has the child elements of make, model, year, colour, engine, number_of_doors, transmission_type and accessories. The engine has child elements called number_of_cylinders and fuel_system.
Thursday, April 15, 2010
Step 8 - Answer the question
a. What is git? Why it is useful?
According to Git site (n.d), Git is a free and open source, distributed version control system to handle everything from small to very large projects with speed and efficiency.
Every Git clone is a full-fledge repository with complete history and full revision tracking capabilities, not dependent on network access or a central server. Especially. (Git, n.d)
As Awebb (2009) stated that, Git is very useful because it shows significant benefits in development process such as
- It develops software collaboratively better while minimizing the influence of code conflicts
- Easy to track
- Branching and merging are fast and easy to do (Git, n.d)
- It is easy to turn any directory tree into a Git repository
References
Awebb (2009). Presentation on managing Drupal projects with Git and GitHub. Retrieved from http://groups.drupal.org/node/27834
Git (n.d). Retrieved from http://git-scm.com/
b. Describe how Sinatra relates to Ruby on Rails
According to wikipedia (2010), Sinatra is a free and open source web application framework and Domain Specific Language (DSL) for quickly creating web-applications in Ruby.It is an alternative to other Ruby web application frameworks such as Ruby on Rails.
Unlike Ruby on Rails, Sinatra does not follow a Model-View-Control (MVC) to create websites. Instead, Sinatra focuses on “quickly creating web-application in Ruby with minimal effort”. (wikipedia, 2010).
As Ron (2007) stated that Rails requires a separates routes file to define how the web application response to request, while Sinatra will automatically add the route, and simply start responding to request just by declaring a new “get” or “post” action
Reference
Ron, E. (2007). Sinatra, a Ruby web framework, and Why it Matters. Retrieved from http://deadprogrammersociety.blogspot.com/2007/10/sinatra-ruby-web-framework-and-why-it.html
Wikipedia (2010). Sinatra (Software). Retrieved from http://en.wikipedia.org/wiki/Sinatra_%28software%29#cite_note-0
c. What is heroku? What is a Heroku “Dyno”? Describe how Heroku makes deployment and scaling of Ruby web applications easy.
According to Heroku site, “Heroku is a cloud application platform for Ruby – a new way of building and deploying web apps”. Deploy any ruby app instantly with a simple and familiar git push. It has many benefits from taking advanced features like HTTP caching, memcached, rack, middleware, and instant scaling built into every app. Never think about hosting or server (Heroku, n.d).
Also flowing to Heroku site, Heroku “Dyno” is roughlt equivalent to an individual Mongrel, Thin, or FastCGI backend in traditional Ruby deployment environments.
Heroku can deploy and scale easily on Ruby because some features below (Heroku, n.d):
- Multi-Tenant: Heroku is a multi-tenant platform and hosting environment
- Fully Managed: Heroku can control all the infrastructure and software layers
- Curation: actively curate each layer
- Everything you need: provide everything needed to run a modern, high-performance, scalable web app.
References
Heroku (n.d). Introduction to Heroku. Retrieved from http://docs.heroku.com/heroku
Heroku (n.d). Dynos. Retrieved from http://docs.heroku.com/dynos
d. Inspect the Hello World application “app.rb” file. Answer these questions:
a. What is the purpose of the “/param/:name method”
That method to get the parameter from “/” and shows the message “Hello World”
b. What happens when the user navigates to the /home page?
The page almost does not change because it will be redirected to itself
c. What is the purpose of the :set directive
It is used to specify a location of file. Static files are served from the ./public directory.
According to Git site (n.d), Git is a free and open source, distributed version control system to handle everything from small to very large projects with speed and efficiency.
Every Git clone is a full-fledge repository with complete history and full revision tracking capabilities, not dependent on network access or a central server. Especially. (Git, n.d)
As Awebb (2009) stated that, Git is very useful because it shows significant benefits in development process such as
- It develops software collaboratively better while minimizing the influence of code conflicts
- Easy to track
- Branching and merging are fast and easy to do (Git, n.d)
- It is easy to turn any directory tree into a Git repository
References
Awebb (2009). Presentation on managing Drupal projects with Git and GitHub. Retrieved from http://groups.drupal.org/node/27834
Git (n.d). Retrieved from http://git-scm.com/
b. Describe how Sinatra relates to Ruby on Rails
According to wikipedia (2010), Sinatra is a free and open source web application framework and Domain Specific Language (DSL) for quickly creating web-applications in Ruby.It is an alternative to other Ruby web application frameworks such as Ruby on Rails.
Unlike Ruby on Rails, Sinatra does not follow a Model-View-Control (MVC) to create websites. Instead, Sinatra focuses on “quickly creating web-application in Ruby with minimal effort”. (wikipedia, 2010).
As Ron (2007) stated that Rails requires a separates routes file to define how the web application response to request, while Sinatra will automatically add the route, and simply start responding to request just by declaring a new “get” or “post” action
Reference
Ron, E. (2007). Sinatra, a Ruby web framework, and Why it Matters. Retrieved from http://deadprogrammersociety.blogspot.com/2007/10/sinatra-ruby-web-framework-and-why-it.html
Wikipedia (2010). Sinatra (Software). Retrieved from http://en.wikipedia.org/wiki/Sinatra_%28software%29#cite_note-0
c. What is heroku? What is a Heroku “Dyno”? Describe how Heroku makes deployment and scaling of Ruby web applications easy.
According to Heroku site, “Heroku is a cloud application platform for Ruby – a new way of building and deploying web apps”. Deploy any ruby app instantly with a simple and familiar git push. It has many benefits from taking advanced features like HTTP caching, memcached, rack, middleware, and instant scaling built into every app. Never think about hosting or server (Heroku, n.d).
Also flowing to Heroku site, Heroku “Dyno” is roughlt equivalent to an individual Mongrel, Thin, or FastCGI backend in traditional Ruby deployment environments.
Heroku can deploy and scale easily on Ruby because some features below (Heroku, n.d):
- Multi-Tenant: Heroku is a multi-tenant platform and hosting environment
- Fully Managed: Heroku can control all the infrastructure and software layers
- Curation: actively curate each layer
- Everything you need: provide everything needed to run a modern, high-performance, scalable web app.
References
Heroku (n.d). Introduction to Heroku. Retrieved from http://docs.heroku.com/heroku
Heroku (n.d). Dynos. Retrieved from http://docs.heroku.com/dynos
d. Inspect the Hello World application “app.rb” file. Answer these questions:
a. What is the purpose of the “/param/:name method”
That method to get the parameter from “/” and shows the message “Hello World”
b. What happens when the user navigates to the /home page?
The page almost does not change because it will be redirected to itself
c. What is the purpose of the :set directive
It is used to specify a location of file. Static files are served from the ./public directory.
Step 7 - Introduce change
Step 7 Introduce change
Change the message "Hello world" to "Welcome to Heroku" by using Vi command
After that do these following commands again
- git init
- git add .
- git commit -m "Change the message"
- git push heroku master
Change the message "Hello world" to "Welcome to Heroku" by using Vi command
After that do these following commands again
- git init
- git add .
- git commit -m "Change the message"
- git push heroku master
Subscribe to:
Posts (Atom)