Server Threats in E-commerce:- The server is highly vulnerable and forms the threat link in the Client-Internet Server Group serving the electronic commerce path between the commerce server and a user.
Servers can be exploited by anyone determined to cause destruction or to acquire information illegally. Most entry points include the wet server and its software, databases, and CGI programs residing on the server.
Server Threats in E-commerce are:-
-
Web server Threats:-
Web server software is designed with web service and convenience as the main design goal. On most machines, web servers can be set up to run at various privilege levels.
The highest privilege level provides the most flexibility and allows programs, including web servers, to execute all machine instructions and to have unlimited access to any part of the system, including highly sensitive and privileged areas.
Correspondingly, the lowest privilege levels provide a logical fence around a running program, preventing it from running whole classes of machine instructions and disallowing its access to all but the least sensitive area of computer storage. The program is given the least privilege it needs to do its job.
The system administrator’s job is to set up accounts and passwords for user’s needs. It is a highly privileged level also called superuser in the in the UNIX environment and its job is to modify sensitive and valuable area for the system.
A Web server threat is caused when we set up a web server to run in high privilege status. Ordinarily, a web server provides ordinary services and regular tasks which can exploit the web server and subsequently executing instructions in privileged mode.
-
Database Threats:-
Security threats to databases usually revolve around unwanted access to data. Electronic commerce system store user data and get product information from databases which are connected to the web server.
Databases connected to the web server have valuable and personal information and if it is accessed by malicious users, it can damage the company.
Most database management systems include security features that rely on usernames and passwords. Once a user is authenticated, specific parts of the databases either store username\password pairs in an unencrypted table or they fail to enforce security at all and rely on the Web server to enforce security.
If unauthorized users obtain user authentication information, they can masquerade as legitimate database users and reveal or download confidential and potentially valuable information.
Trojan horse programs hidden within the database system can also reveal information by changing the access rights of various user groups. A Trojan horse can even remove access controls within a database, giving all users complete access to the data- including intruders.
-
Common Gateway Interface(CGI) Threats:-
Common Gateway Interface (CGI) defines how the server and the browser communicate. A CGI script is simply a script that conforms to the CGI standard. Many web-servers run CGI programs to perform some action based on input from the web client.
If these programs do not validate input and pass it on to the shell, then it can provide access to an attacker. For example, CGI scripts may pass commands that may delete files on the server, or mail a password file to the attackers.
Also Read:-
What do you mean by e-commerce?