E-Commerce Security & Legal Frameworks: Threats, Safeguards & Laws

Core Concepts: Security in E-Commerce

1. What is E-Commerce Security?

E-commerce security refers to the protection of data, transactions, and systems from unauthorized access, fraud, or cyberattacks during online business operations. It ensures confidentiality, integrity, and availability (CIA triad) of sensitive information like customer details, payment data, and business records.

classDiagram
    class SecurityGoals {
        +Confidentiality: Data accessible only to authorized users
        +Integrity: Data accurate and unaltered
        +Availability: Systems operational when needed
        +Non-repudiation: Proof of transaction authenticity
    }
    class Threats {
        +Sniffing: Eavesdropping on data
        +Spoofing: Impersonating legitimate entities
        +Phishing: Fraudulent communication
        +Malware: Viruses, ransomware
    }
    SecurityGoals --> Threats : "Must defend against"

Why it matters:

• Trust: Customers won’t transact if they fear data leaks (e.g., credit card fraud).
• Compliance: Laws like Nepal’s IT Act 2064 and Payment System Act 2063 mandate security measures.
• Reputation: A breach (e.g., Daraz’s past security lapses) can destroy brand value.

2. Key Security Threats in E-Commerce

A. Passive Attacks (Eavesdropping)

• Sniffing: Intercepting data transmitted over networks (e.g., Wi-Fi, public networks). Example: A hacker using Wireshark to capture unencrypted login credentials on a café’s open Wi-Fi. Real-world impact: eSewa users risk exposing their transaction PINs if they log in on unsecured networks.

B. Active Attacks (Data Tampering)

• Spoofing: Fake identities (e.g., email spoofing, IP spoofing). Example: A scammer sends an email pretending to be from Khalti, asking users to "verify" their account via a phishing link.
• Man-in-the-Middle (MITM): Intercepting and altering communications between two parties. Example: A hacker redirects a Ncell mobile banking user to a fake login page to steal OTPs.

C. Malicious Code

• Viruses/Trojans: Malware that corrupts systems (e.g., ransomware locking e-commerce databases).
• SQL Injection: Exploiting vulnerabilities in website databases to steal data. Example: A hacker injects SQL code into a Daraz search bar to extract customer records.

D. Denial-of-Service (DoS) Attacks

• Overloading a website to crash it (e.g., Nepal Stock Exchange (NEPSE) during high trading volumes).
• Real-world case: In 2021, a DoS attack disrupted Pathao’s ride-hailing service in Kathmandu for hours.

3. Security Safeguards: How E-Commerce Protects Itself

A. Technical Controls

B. Non-Repudiation: Proof You Can’t Deny

• Ensures a party cannot deny their actions (e.g., sending a payment).
• How it works:
  1. Sender encrypts data with their private key.
  2. Receiver decrypts with the sender’s public key.
  3. If decryption succeeds, the sender cannot claim they didn’t send it.
• Real-world use: When you transfer money via eSewa, the system generates a transaction ID that both parties can verify.

sequenceDiagram
    participant A as Alice (Buyer)
    participant B as Bob (Seller)
    participant System as eSewa System
    A->>System: Sends payment request (signed with private key)
    System->>B: Delivers payment + digital signature
    B->>System: Confirms receipt (verifies signature)
    Note over System: Non-repudiation: Alice can't deny sending money.

4. Legal Frameworks: Laws Protecting E-Commerce

A. Nepal’s Legal Landscape

B. Global Standards

• GDPR (EU): Strict data privacy rules (e.g., Google must disclose data breaches).
• PCI-DSS: Payment Card Industry standards for secure transactions (used by Ncell’s mobile banking).

In the Real World

1. eSewa: Encryption and Non-Repudiation

• How it uses security:
  • Encryption: All transactions use AES-256 (military-grade encryption).
  • Non-repudiation: Every payment has a unique transaction ID and digital timestamp.
• Real scenario: If a user claims they didn’t authorize a Rs. 50,000 transfer, eSewa’s logs (with digital signatures) prove otherwise.

2. Khalti: Multi-Factor Authentication (MFA)

• How it works:
  • Step 1: User enters phone number + PIN.
  • Step 2: System sends an OTP to the registered number.
  • Step 3: OTP is required for any transaction > Rs. 10,000.
• Why it matters: Prevents account takeovers even if a hacker steals the PIN.

3. Daraz: Fraud Detection with AI

• How it uses security:
  • Machine learning flags suspicious orders (e.g., bulk purchases with the same card).
  • Two-factor verification for high-value items (e.g., electronics).
• Real case: In 2022, Daraz blocked 12,000 fraudulent orders using AI before they were processed.

Worked Example: Securing a Payment on Pathao

Scenario: You book a ride on Pathao and pay via Khalti. Trace the security steps:

1. HTTPS Connection:

   • Your phone connects to Pathao’s server via TLS 1.3 (encrypted).

   flowchart LR
     A["Your Phone"] -->|"HTTPS"| B["Pathao Server"]
     B -->|"TLS Handshake"| A

2. Authentication:

   • Pathao verifies your Khalti account via OAuth 2.0 (no password sharing).

3. Payment Authorization:

   • Khalti sends a signed request to your phone:
     • {"amount": 350, "transaction_id": "TXN123", "signature": "abc123..."}
   • Your phone verifies the signature using Khalti’s public key.

4. Non-Repudiation:

   • Both Pathao and Khalti log the transaction with:
     • Timestamp: 2024-05-20T14:30:00
     • Digital signature: SHA-256 hash of TXN123

5. Fraud Check:

   • Pathao’s AI checks for:
     • Unusual location (e.g., ride from Kathmandu to Pokhara in 10 mins).
     • Device fingerprint (e.g., new device logging in).

Outcome: If any step fails (e.g., signature mismatch), the payment is blocked.

Comparison Table: Security Threats vs. Safeguards

Exam Tip

What Examiners Love to Test

1. Definitions:

   • Differentiate confidentiality (data secrecy) vs. integrity (data accuracy).
   • Explain non-repudiation with an example (e.g., eSewa transaction logs).

2. Threat Analysis:

   • Describe 2 threats (e.g., sniffing + phishing) and how they harm e-commerce.
   • Link to real platforms: "Sniffing can expose Khalti’s OTPs if sent over HTTP."

3. Legal Compliance:

   • Match laws to scenarios:
     • "A Daraz seller refuses a refund" → Consumer Protection Act.
     • "eSewa leaks user data" → IT Act 2064.

4. Security Safeguards:

   • Explain how MFA works (not just "it’s secure").
     • "Khalti’s MFA uses time-based OTPs (TOTP) generated by Google Authenticator."
   • Draw a diagram of SSL handshake or digital signature process.

5. Case Studies:

   • Analyze a breach: "How could Pathao prevent MITM attacks?" → Use HTTPS + certificate pinning.

Common Mistakes to Avoid

• ❌ Saying "firewall" is the only security measure (mention encryption + MFA too).
• ❌ Ignoring legal frameworks (always link threats to laws like IT Act).
• ❌ Vague answers like "security is important" → Be specific (e.g., "SSL prevents sniffing").

Quick Revision Checklist

• Can you list 3 security threats and their real-world examples?
• Do you know how non-repudiation works in eSewa/Khalti?
• Can you compare Nepal’s IT Act with GDPR in one sentence?
• Can you draw a TLS handshake or digital signature flow?
• Do you remember one AI-based fraud detection used by Daraz/Pathao?