E‑Commerce & Online Transactions
(NCO – Cyber Olympiad – Networking, Internet & Cyber Security)
1. Simple Explanation
E‑commerce is the buying & selling of goods or services over the internet.
An online transaction is the sequence of steps that moves a customer’s intent to purchase into an authenticated, authorised, and settled payment.
Key components:
- Front‑end – website/app where the customer selects items.
- Back‑end – inventory, order‑management, and payment‑gateway integration.
- Security layer – encryption, authentication, and fraud‑prevention methods that protect data and money.
2. Key Points
| # | Topic | Why It Matters |
|---|---|---|
| 1 | E‑commerce Models | B2C, B2B, C2C, C2B – each has different security & compliance needs. |
| 2 | Transaction Flow | 1️⃣ Browse → 2️⃣ Cart → 3️⃣ Checkout → 4️⃣ Payment → 5️⃣ Confirmation. |
| 3 | Payment Gateways | Bridge merchant accounts & card networks; perform authorisation & settlement. |
| 4 | Encryption | HTTPS (TLS) protects data in transit; end‑to‑end encryption for card data. |
| 5 | Authentication | 2‑factor (2FA), OAuth, SAML; reduce credential‑based attacks. |
| 6 | Fraud Detection | Velocity checks, device fingerprinting, machine‑learning scoring. |
| 7 | PCI DSS | 12 requirements covering data protection, network segmentation, logging, etc. |
| 8 | Tokenization & 3D Secure | Replace card numbers with tokens; add an extra authentication step. |
| 9 | Secure Coding | OWASP Top‑10: Injection, XSS, broken authentication, etc. |
| 10 | Legal & Privacy | GDPR, CCPA, consumer‑rights notices, data‑retention policies. |
3. Worked Example
Scenario: Alice wants to buy a laptop from ShopEasy using her Visa card.
| Step | What Happens | Security Controls |
|---|---|---|
| 1. Browser → ShopEasy | Alice’s browser sends an HTTPS request to https://shopeasy.com. |
TLS handshake; server presents a valid X.509 cert. |
| 2. Cart Creation | Item added to cart; session cookie set. | Cookie flagged Secure; HttpOnly; SameSite=Strict. |
| 3. Checkout | Alice enters delivery address & selects “Pay with Card”. | Client‑side input validation; CSRF token in form. |
| 4. Tokenization | Card details entered → JavaScript sends them to the Payment Gateway (PG) via HTTPS. | Card data never reaches ShopEasy servers; PG replaces it with a token. |
| 5. Authorisation | PG forwards token + amount to the card network; card issuer approves. | 3D Secure challenge (OTP sent to phone) may be triggered. |
| 6. Response | PG returns AUTH – Approved and a transaction ID to ShopEasy. |
Response signed by PG; verified by ShopEasy. |
| 7. Order Confirmation | ShopEasy updates DB, sends email with order ID, and redirects Alice to a secure “Thank‑you” page. | Email sent over TLS; order ID matches PG transaction ID. |
| 8. Settlement | At day‑end, PG batches authorisations & sends settlement to ShopEasy’s merchant account. | PCI‑compliant logs retained; audit trail available. |
Security‑critical moments
- TLS protects every HTTP request/response.
- Tokenization ensures ShopEasy never stores raw PAN.
- 3D Secure adds an extra factor before authorisation.
- PCI DSS logging ensures traceability of all payment events.
4. Quick Revision Summary
| Topic | Take‑away |
|---|---|
| E‑commerce models | B2C is most common; B2B requires stricter audit trails. |
| TLS/HTTPS | Mandatory for all pages that handle personal/payment data. |
| Payment gateway | Handles card authorisation; must be PCI‑compliant. |
| Tokenization | Replace PAN with tokens; reduces scope of PCI DSS. |
| 3D Secure / 2FA | Adds an extra authentication step; combats credential theft. |
| PCI DSS | 12 requirements; focus on data protection, network segmentation, logging. |
| Fraud detection | Use velocity checks, device fingerprinting, ML scoring. |
| Secure coding | Follow OWASP Top‑10; sanitize inputs, use prepared statements. |
| GDPR/CCPA | Provide privacy notices, right to delete, data‑subject requests. |
| Audit & Monitoring | Log all payment events, monitor for anomalies, perform regular penetration tests. |
Final Tips for the Olympiad
- Understand the flow – diagram each step of an online transaction.
- Remember the “security pillars”: confidentiality (TLS), integrity (signed messages), availability (DDoS protection).
- Know the standards – PCI DSS, OWASP, ISO/IEC 27001.
- Practice – build a mock checkout page and walk through each security check.
Good luck!