Web Commerce Security: Design and Development -- Contents -- Foreword by John Donahoe -- Foreword by Scott Thompson -- Introduction -- Part I: Overview of Commerce -- Chapter 1: Internet Era: E-Commerce -- Evolution of Commerce -- Hard vs. Digital Goods -- Payment -- Money -- Financial Networks -- Distributed Computing: Adding E to Commerce -- Client/Server -- Grid Computing -- Cloud Computing -- Cloud Security -- Summary -- Notes -- Chapter 2: Mobile Commerce -- Consumer Electronics Devices -- Mobile Phone and M-Commerce -- Landscape -- M- vs. E-Commerce -- State of Mobile -- Mobile Technologies: Mosquito on Steroids -- Carrier Networks -- Stacks -- Summary -- Notes -- Chapter 3: Important "Ilities" in Web Commerce Security -- Confidentiality, Integrity, and Availability -- Confidentiality -- Integrity -- Availability -- Extensibility -- Black Box Extensibility -- White Box Extensibility (Open Box) -- White Box Extensibility (Glass Box) -- Gray Box Extensibility -- Fault Tolerability -- High Availability -- Telecommunications Network Fault Tolerance -- Interoperability -- Additional Interoperability Standards -- Testing for Interoperability -- Maintainability -- Manageability -- Modularity -- Monitorability -- Intrusion Detection -- Penetration Testing -- Violation Analysis -- Operability -- Protection of Resources and Privileged Entities -- Categories of Web Commerce Operability Controls -- Portability -- Predictability -- Reliability -- Ubiquity -- Usability -- Scalability -- Accountability -- Audit Ability -- Traceability -- Summary -- Notes -- Part II: E-Commerce Security -- Chapter 4: E-Commerce Basics -- Why E-Commerce Security Matters -- What Makes a System Secure -- Risk-Driven Security -- Security and Usability -- Usability of Passwords -- Practical Notes -- Scalable Security -- Securing Your Transactions -- How Secure Is Secure?.

Summary -- Notes -- Chapter 5: Building Blocks: Your Tools -- Cryptography -- The Role of Cryptography -- Symmetric Cryptosystems -- Asymmetric Cryptosystems -- Digital Signatures -- Random Number Generation -- Public Key Certification Systems-Digital Certificates -- Data Protection -- Access Control -- Controls -- Models for Controlling Access -- System Hardening -- Service Level Security -- Host Level Security -- Network Security -- Summary -- Notes -- Chapter 6: System Components: What You Should Implement -- Authentication -- User Authentication -- Network Authentication -- Device Authentication -- API Authentication -- Process Authentication -- Authorization -- Non-Repudiation -- Privacy -- Privacy Policy -- Privacy-Related Legislation and Guidelines -- European Union Principles -- Health Care-Related Privacy Issues -- The Platform for Privacy Preferences -- Electronic Monitoring -- Information Security -- Security Management Concepts -- Data and Information Classification -- Information Classification Benefits -- Information Classification Concepts -- Data Categorization -- Bell-LaPadula Model -- System and Data Audit -- Syslog -- SIEM -- Defense in Depth -- Principle of Least Privilege -- Trust -- Isolation -- Virtualization -- Sandbox -- IPSec Domain Isolation -- Security Policy -- Senior Management Policy Statement -- NIST Policy Categories -- Communications Security -- Inter-Network Security -- Summary -- Notes -- Chapter 7: Trust but Verify: Checking Security -- Tools to Verify Security -- Vulnerability Assessment and Threat Analysis -- Intrusion Detection and Prevention Using Snort -- Network Scanning Using Nmap -- Web Application Survey -- Vulnerability Scanning -- Penetration Testing -- Wireless Reconnaissance -- Summary -- Notes -- Chapter 8: Threats and Attacks: What Your Adversaries Do -- Basic Definitions -- Target -- Threat.

Attack -- Control -- Same-Origin Policy -- Common Web Commerce Attacks -- Broken Authentication and Session Management Attack -- Cross-Site Request Forgery Attack -- Cross-Site Scripting Attack -- DNS Hijacking Attack -- Failure to Restrict URL Access Attack -- Injection Flaws -- Insufficient Transport Layer Protection Attack -- Insecure Cryptographic Storage Attack -- Insecure Direct Object Reference Attack -- Phishing and Spamming Attack -- Rootkits and Their Related Attacks -- Security Misconfiguration Attack -- Unvalidated Redirects and Forwards Attack -- Summary -- Notes -- Chapter 9: Certification: Your Assurance -- Certification and Accreditation -- The Certification Process -- Standards and Related Guidance -- Trusted Computer System Evaluation Criteria -- Common Criteria ISO/IEC 15408 -- Defense Information Assurance Certification and Accreditation Process -- Office of Management and Budget Circular A-130 -- The National Information Assurance Certification and Accreditation Process -- Federal Information Security Management Act -- Federal Information Technology Security Assessment Framework -- FIPS 199 -- FIPS 200 -- Additional Guidance -- Related Standards Bodies and Organizations -- Jericho Forum -- The Distributed Management Task Force -- International Organization for Standardization/ International Electrotechnical Commission -- The European Telecommunications Standards Institute -- Storage Networking Industry Association -- The Open Web Application Security Project -- NIST SP 800-30 -- Certification Laboratories -- The Software Engineering Center Software Assurance Laboratory -- SAIC -- ICSA Labs -- The Systems Security Engineering Capability Maturity Model -- Value of Certification -- When It Matters -- When It Does Not -- Certification Types -- Common Criteria -- MasterCard CAST -- EMV -- Other Evaluation Criteria -- NSA.

FIPS 140 Certification and NIST -- Summary -- Notes -- Appendix A: Computing Fundamentals -- Introduction -- Hardware -- Central Processing Unit -- Memory and Storage -- Input and Output -- Popular Architectures -- Software -- Underware -- Operating System -- Middleware -- Applications -- Programming Languages -- Summary -- Appendix B: Standardization and Regulatory Bodies -- ANSI -- COBIT -- COSO -- CSA -- Ecma -- ETSI -- FIPS -- GlobalPlatform -- IANA -- IEC -- IETF -- ISO -- Kantara -- NIST -- OASIS -- OAuth -- OpenID -- OpenSAF -- PCI -- SAF -- SOX -- The Open Group -- W3C -- WASC -- Notes -- Appendix C: Glossary of Terms -- Appendix D: Bibliography -- Index.