E-commerce Security and Payment Systems Part 1

E-commerce 2019: business. technology. society., 15e (Laudon/Traver) Chapter 5 E-commerce Security and Payment Systems 1) Confidentiality is sometimes confused with: A) privacy. B) authenticity. C) integrity. D) nonrepudiation. Answer: A 2) ________ is the ability to ensure that e-commerce participants do not deny their online actions. A) Nonrepudiation B) Authenticity C) Availability D) Integrity Answer: A 3) ________ is the ability to identify the person or entity with whom you are dealing on the Internet. A) Nonrepudiation B) Authenticity C) Availability D) Integrity Answer: B 4) Which of the following is an example of an integrity violation of e-commerce security? A) A website is not actually operated by the entity the customer believes it to be. B) A merchant uses customer information in a manner not intended by the customer. C) A customer denies that he is the person who placed the order. D) An unauthorized person intercepts an online communication and changes its contents. Answer: D 5) ________ is the ability to ensure that an e-commerce site continues to function as intended. A) Nonrepudiation B) Authenticity C) Availability D) Integrity Answer: C 6) Which of the following is an example of an online privacy violation? A) your e-mail being read by a hacker B) your online purchasing history being sold to other merchants without your consent C) your computer being used as part of a botnet D) your e-mail being altered by a hacker Answer: B 7) ________ is the ability to ensure that messages and data are only available to those authorized to view them. A) Confidentiality B) Integrity C) Privacy D) Availability Answer: A 8) Typically, the more security measures added to an e-commerce site, the slower and more difficult it becomes to use. Answer: TRUE 9) Why is it difficult to accurately estimate the actual amount of cybercrime? Answer: It is difficult to accurately estimate the actual amount of cybercrime, in part, because many companies are hesitant to report it due to the fear of losing the trust of their customers, and because even if crime is reported, it may be difficult to quantify the actual dollar amount of the loss. 10) Which of the following statements about data breaches in 2017 is not true? A) According to the Identity Theft Resource Center, the number of breaches in 2017 increased by almost 45% from 2016. B) According to the Identity Theft Resource Center, over 50% of data breaches involved social security numbers. C) According to the Identity Theft Resource Center, employee error was the leading cause of data breaches. D) According to the Identity Theft Resource Center, data breaches involving the business sector represented over 55% of all breaches. Answer: C 11) All of the following are examples of cryptocurrencies except: A) Ethereum. B) Ripple. C) Zelle. D) Monero. Answer: C 12) The overall rate of online credit card fraud is ________ of all online card transactions. A) less than 1% B) around 5% C) around 10% D) around 15% Answer: A 13) Which of the following did the Internet Advertising Bureau urge advertisers to abandon? A) HTML B) HTML5 C) Adobe Flash D) Adobe Acrobat Answer: C 14) Accessing data without authorization on Dropbox is an example of a: A) social network security issue. B) cloud security issue. C) mobile platform security issue. D) sniffing issue. Answer: B 15) Which of the following is not a key factor for establishing e-commerce security? A) data integrity B) technology C) organizational policies D) laws and industry standards Answer: A 16) Conficker is an example of a: A) virus. B) worm. C) Trojan horse. D) botnet. Answer: B 17) Which of the following is the leading cause of data breaches? A) theft of a computer B) accidental disclosures C) hackers D) DDoS attacks Answer: C 18) Software that is used to obtain private user information such as a user's keystrokes or copies of e-mail is referred to as: A) spyware. B) a backdoor. C) browser parasite. D) adware. Answer: A 19) According to Symantec, almost half of the e-mail addresses involved in business e-mail compromise (BEC) phishing that it analyzed had an IP address originating in: A) China. B) Russia. C) Nigeria. D) North Korea. Answer: C 20) What is the most frequent cause of stolen credit cards and card information today? A) lost cards B) the hacking and looting of corporate servers storing credit card information C) sniffing programs D) phishing attacks Answer: B 21) Which dimension(s) of security is spoofing a threat to? A) integrity B) availability C) integrity and authenticity D) availability and integrity Answer: C 22) Which of the following is not an example of malicious code? A) scareware B) Trojan horse C) bot D) sniffer Answer: D 23) The attack on Dyn Inc. in 2016 is an example of which of the following? A) SQL injection attack B) browser parasite C) DDoS attack D) MitM attack Answer: C 24) Beebone is an example of which of the following? A) worm B) botnet C) phishing D) hacktivism Answer: B 25) Malware that comes with a downloaded file that a user requests is called a: A) Trojan horse. B) backdoor. C) drive-by download. D) PUP. Answer: C 26) Which of the following is not an example of a potentially unwanted program (PUP)? A) adware B) browser parasite C) drive-by download D) spyware Answer: C 27) Which of the following was designed to cripple Iranian nuclear centrifuges? A) Stuxnet B) Shamoon C) Snake D) Storm Answer: A 28) Automatically redirecting a web link to a different address is an example of which of the following? A) sniffing B) social engineering C) pharming D) DDoS attack Answer: C 29) According to the Identity Theft Resource Center, the number of data breaches in 2017 increased by ________ compared to 2016. A) 15% B) 45% C) 55% D) 75% Answer: C 30) According to Ponemon Institute's 2017 survey, which of the following was not among the causes of the most costly cybercrimes? A) malicious insiders B) malicious code C) denial of service D) botnets Answer: D 31) ________ typically attack governments, organizations, and sometimes individuals for political purposes. A) Crackers B) White hats C) Grey hats D) Hacktivists Answer: D 32) IoT botnets became the preferred platform for launching DDoS attacks in 2017. Answer: TRUE Difficulty: Moderate AACSB: Information technology Learning Objective: 5.2: Identify the key security threats in the e-commerce environment. 33) A Trojan horse appears to be benign, but then does something other than expected. Answer: TRUE 34) Phishing attacks rely on browser parasites. Answer: FALSE 35) WannaCry is an example of ransomware. Answer: TRUE 36) Spoofing is the attempt to hide a hacker's true identity by using someone else's e-mail or IP address. Answer: TRUE 37) Exploit kits can be purchased by users to protect their computers from malware. Answer: FALSE 38) A drive-by download is malware that comes with a downloaded file that a user intentionally or unintentionally requests. Answer: TRUE 39) FREAK is an example of a software vulnerability. Answer: TRUE 40) What is the Internet of Things (IoT) and what security issues and challenges does it raise? Answer: The Internet of Things (IoT) involves the use of the Internet to connect a wide variety of sensors, devices, and machines, and is powering the development of a multitude of smart connected things, such as home electronics (smart TVs, thermostats, home security systems, and more). IoT also includes connected cars, medical devices and industrial equipment that supports manufacturing, energy, transportation, and other industrial sectors. Unfortunately, IoT raises a host of security issues similar to existing security challenges, but even more challenging, given the need to deal with a wider range of devices, operating in a less controlled, and global environment. In a world of connected things, the devices, the data produced and used by the devices, and the systems and applications supported by those devices, can all potentially be attacked. For instance, many IoT devices, such as sensors, are intended to be deployed on a much greater scale than traditional Internet-connected devices, creating a vast quantity of interconnected links that can be exploited. Existing tools, methods, and strategies need to be developed to deal with this unprecedented scale. Many instances of IoT consist of collections of identical devices that all have the same characteristics, which magnifies the potential impact of security vulnerabilities. Many IoT devices are anticipated to have a much longer service life than typical equipment, which raises the possibility that devices may "outlive" the manufacturer, leaving them without long-term support that creates persistent vulnerabilities. Many IoT devices are intentionally designed without the ability to be upgraded, or the upgrade process is difficult, which raises the possibility that vulnerable devices cannot or will not be fixed, leaving them perpetually vulnerable. Many IoT devices do not provide the user with visibility into the workings of the device or the data being produced, nor alert the user when a security problem arises, so users may believe an IoT device is functioning as intended when in fact, it may be performing in a malicious manner. Finally, some IoT devices, such as sensors, are unobtrusively embedded in the environment such that a user may not even be aware of the device, so a security breach might persist for a long time before being noticed. 41) Define the terms tiger team, white hat, black hat, and grey hat and discuss the difference between them. Answer: Groups of hackers called tiger teams are sometimes used by corporate security departments to test their own security measures. By hiring hackers to break into the system from the outside, the company can identify weaknesses in the computer system’s armor. These “good hackers” became known as white hats because of their role in helping organizations locate and fix security flaws. White hats do their work under contract, with agreement from the target firms that they will not be prosecuted for their efforts to break in. Hardware and software firms such as Apple, Microsoft, Intel, HP, and many others pay bounties of $25,000 to $250,000 to white hat hackers for discovering bugs in their software and hardware. In contrast, black hats are hackers who engage in the same kinds of activities but without pay or any buy-in from the targeted organization, and with the intention of causing harm. They break into websites and reveal the confidential or proprietary information they find. These hackers believe strongly that information should be free, so sharing previously secret information is part of their mission. Somewhere in the middle are the grey hats, hackers who believe they are pursuing some greater good by breaking in and revealing system flaws. Grey hats discover weaknesses in a system’s security, and then publish the weakness without disrupting the site or attempting to profit from their finds. Their only reward is the prestige of discovering the weakness. Grey hat actions are suspect, however, especially when the hackers reveal security flaws that make it easier for other criminals to gain access to a system. 42) What is a sniffing attack and how does it differ from a MitM attack? Answer: A sniffer is a type of eavesdropping program that monitors information traveling over a network. When used legitimately in a sniffing attack, hackers use sniffers to steal proprietary information from a network, including passwords, e-mail messages, company files, and confidential reports. A man-in-the-middle (MitM) attack also involves eavesdropping but is more active than a sniffing attack, which typically involves passive monitoring. In a MitM attack, the attacker can intercept communications between two parties who believe they are directly communicating with one another, when in fact the attacker is controlling the communications. 43) Discuss and explain the various types of malicious code and how they work. Include the different types of viruses. Answer: Malicious code includes a variety of threats such as viruses, worms, Trojan horses, ransomware, and bot programs. A virus is a computer program that can replicate or make copies of itself and spread to other files. Viruses can range in severity from simple programs that display a message or graphic as a "joke" to more malevolent code that will destroy files or reformat the hard drive of a computer, causing programs to run incorrectly. Worms are designed to spread not only from file to file but from computer to computer and do not necessarily need to be activated in order to replicate. A Trojan horse is not itself a virus because it does not replicate but it is a method by which viruses or other malicious code can be introduced into a computer system. It appears benign and then suddenly does something harmful. For example, it may appear to be only a game and then it will steal passwords and mail them to another person. A backdoor is a feature of worms, viruses, and Trojans that allow attackers to remotely access compromised computers. Ransomware is a type of malware (often a worm) that locks your computer or files to stop you from accessing them. Bot programs are a type of malicious code that can be covertly installed on a computer when it is attached to the Internet. Once installed, the bot responds to external commands sent by the attacker, and many bots can be coordinated by a hacker into a botnet.