Keamanan Internet dan Sistem Pembayaran Elektronik (Internet Security and Electronic Payment Systems) Kuliah 6

A Typical E-commerce Transaction Copyright © 2002 Pearson Education, Inc.

Vulnerable Points in an E-commerce Environment Copyright © 2002 Pearson Education, Inc.

Bentuk Ancaman Keamanan Internet Unauthorized Access Akses atau penggunaan sistem komputer untuk menghadang transmisi dan mencuri informasi Data Alteration Mengubah isi transaksi – nama pengguna, nomor kartu kredit, jumlah pembayaran – pada saat transmisi Monitoring “mencuri dengar” pada informasi rahasia Spoofing Situs palsu untuk mencuri data pengguna Denial of Service Menutup situs atau menolak akses pengunjung Repudiation Tidak mengakui terjadinya transaksi Spamming atau e–mail bombing Pengiriman e–mail “sampah” ke banyak individu sekaligus Virus, Worms dan Trojan Horse Parasitic Virus, Boot Sector Virus, Stealth Virus, Polymorphic Virus, Macro Virus Ancaman tidak disengaja Bencana alam, kerusakan peralatan, software bugs, kesalahan entry data

Tools Available to Achieve Site Security Copyright © 2002 Pearson Education, Inc.

Teknologi Keamanan Data Disaster Recovery Plan Fault–Tolerant Systems, Mirrored Disks, Disk Duplexing, Multiple Lines, Different Networks, Peralatan Tambahan dan Uninterrupted Power Supply (UPS) Akses Kontrol Fisik Akses Kontrol Logical User Profiles, Biometrics dan Firewalls Deteksi Unauthorized Access Audit Logs dan Entrapment Server Enkripsi Kriptografi Asimetrik, Kriptografi Simetrik Proteksi Terhadap Virus

Public Key Cryptography: Creating a Digital Envelope Page 254, Figure 5.8 Copyright © 2002 Pearson Education, Inc.

Digital Certificates and Public Key Infrastructure Page 255, Figure 5.9 Copyright © 2002 Pearson Education, Inc.

Keamanan Internet 5 persyaratan keamanan internet (situs web) : Kebebasan Pribadi (Privacy) : kemampuan untuk mengontrol siapa yang dapat / boleh melihat (dan siapa yang tidak boleh melihat) informasi tertentu Kesahihan (Authenticity) : kemampuan untuk mengetahui identitas pihak yang diajak berkomunikasi / bertransaksi Integritas (Integrity) : menjamin informasi yang ditransmisikan atau disimpan tidak berubah Ketersediaan (Availability) : kemampuan untuk mengetahui apakah informasi dan layanan komunikasi tersedia atau tidak Menahan (Blocking) : kemampuan untuk menahan gangguan dan informasi yang tidak diinginkan

Electronic Data Interchange (EDI) EDI consists of standardized electronic-message formats (transaction sets) for business documents such as requests for quotations, purchase orders, purchase change orders, bill of lading, receiving advices, and invoices. To move to EDI, a company must have computerized accounting records and establish trading partners who agree to exchange EDI transactions. Benefits of EDI: improved in overall record keeping quality, reduced inventory, better information for mgt decision making. Computer-to-computer exchange of business information has become an increasingly popular form of electronic commerce. EDI enables firms to exchange business information faster, more cheaply, and more accurately than using paper-based systems. EDI used in manufacturing, shipping, warehousing, utilities, pharmaceuticals, construction, petroleum, metals, banking, government, health care, etc.

Document Flow without EDI

Document Flow with EDI

Sistem Pembayaran Elektronik Electronic Cash (Digital Cash / eCash / Cyber Cash) Electronic Checks (eCheck) Prepaid Card and Accounts Credit Card and Accounts Card Technologies : Magnetic Cards, Smart Cards

Electronic Credit Card System on the Internet The Players Cardholder Merchant (seller) Issuer (your bank) Acquirer (merchant’s financial institution, acquires the sales slips) Brand (VISA, Master Card)

Credit Card Procedure (offline and online) Cardholder Merchant credit card Card Brand Company Payment authorization, payment data Issuer Bank Cardholder Account Acquirer Bank Merchant account debit data payment data payment data amount transfer Credit Card Procedure (offline and online) 15 © Prentice Hall, 2000

Electronic Fund Transfer (EFT) on the Internet Payer Payee Cyber Bank Cyber Bank Payment Gateway Payment Gateway Bank Bank VAN Automated Clearinghouse VAN An Architecture of Electronic Fund Transfer on the Internet

Debit Cards A delivery vehicle of cash in an electronic form Mondex, VisaCash applied this approach Either anonymous or onymous CyberCash has commercialized a debit card named CyberCoin as a medium of micropayments on the Internet

Electronic Cash and Micropayments Smart Cards The concept of e-cash is used in the non-Internet environment Plastic cards with magnetic stripes (old technology) Includes IC chips with programmable functions on them which makes cards “smart” One e-cash card for one application Recharge the card only at designated locations, such as bank office or a kiosk. Future: recharge at your PC e.g. Mondex & VisaCash

Electronic Money DigiCash The analogy of paper money or coins Expensive, as each payment transaction must be reported to the bank and recorded Conflict with the role of central bank’s bill issuance Legally, DigiCash is not supposed to issue more than an electronic gift certificate even though it may be accepted by a wide number of member stores

Electronic Money (cont.) Stored Value Cards No issuance of money Debit card — a delivering vehicle of cash in an electronic form Either anonymous or onymous Advantage of an anonymous card the card may be given from one person to another Also implemented on the Internet without employment of an IC card

Electronic Money (cont.) Smart card-based e-cash Can be recharged at home through the Internet Can be used on the Internet as well as in a non-Internet environment Ceiling of Stored Values To prevent the abuse of stored values in money laundry S$500 in Singapore; HK$3,000 in Hong Kong Multiple Currencies Can be used for cross border payments

Teknologi Keamanan Pembayaran Elektronik Authentication Digital Signatures Digital Certificates Secure Socket Layer (SSL) Secure Electronic Transaction (SET) Digital Wallet

Secure Negotiated Sessions Using SSL Copyright © 2002 Pearson Education, Inc.

Firewalls and Proxy Servers Copyright © 2002 Pearson Education, Inc.