Bảo mật Tất cả các thông tin cung cấp cho khách hàng được bảo mật và phải được bảo vệ trong truyền tải cũng như sau khi khách hàng nhận được thông tin. Thanh toán thường được thực hiện thông qua một cơ chế khác (đối với dịch vụ thuê bao) nên không có thông tin thẻ tín dụng phải được xử lý bởi các dịch vụ thương mại điện tử. | 185 Chapter 11 E-Commerce Security Needs Confidentiality All of the information provided to the customers is confidential and must be protected in transmission as well as after the customer gets the information. Payment is normally made through another mechanism for the subscription service so no credit card information must be handled by the e-commerce service. Integrity The customer will want to have integrity of the information provided so there must be some assurance that information in the organization s database has not been tampered with. Accountability Since the customers purchase subscriptions to the information the organization will need to have some form of identification and authentication so that only subscribers can view the information. If some customers are billed by their usage of the system an audit trail must be kept so that billing information can be captured. Distribution of Information As a last example let s take a manufacturing organization that uses distributors to sell its goods. Each distributor requires pricing information as well as technical specifications on current models. The pricing information may be different for each distributor and the manufacturer considers the pricing information to be confidential. Distributors can make orders for goods through the service and report defects or problems with products. Distributors can also check to see the status of orders previously made. Based on this scenario we can examine the security requirements for each of the base security services Confidentiality Price sheets orders and defect reports are confidential. In addition each distributor must be limited in which price sheets and orders can be seen. Integrity The price sheets must be protected from unauthorized modification. Each order must be correct all through the system. Accountability The manufacturer will need to know which distributor is requesting a price sheet or making an order so that the correct information may be provided. .
