Security: WebsRUs

 Background: 

Over the past two years E-kin’s business has grown to include more than Place University. E-Kin has contracted and built facilities near three other colleges in surrounding states.  To support these brick-and-mortar endeavors at the same time their e-commerce business surged, E-Kin realized they needed to build up their programming staff and hardware.  They elected to out-source this portion of their business.  So they hired WebsRUs, a highly recommended firm, utilized by other e-commerce businesses small and large that experienced great success.

In coordination with E-kin's Promotional Marketing Manager, WebsRUs developed and operated four sites of E-kin.  E-kin and WebsRUs choose to operate their systems on Unix servers equipped with Apache web servers and a combination of Java, XML, HTML, and JavaScript applications.  The debut of the first site followed by the remaining three went fantastically.  Within a six-month timeframe, E-kin recuperated the original cost of development.  Sales started steady and picked up dramatically when students got word of the E-kin site.  On each site, they built chat rooms for students and their particular hobbies and interests.   As long as students provided their student identifications, they could enter.

Two of E-kin sites were particularly successful and consumed sixty percent of their business.  Students flocked to these sites since WebsRUs and E-kin made a strident effort to update the web design to reflect the new designs of their merchandise. 

Scenario: 

Despite high security measures taken by WebsRUs, a patch needed to correct an SSH cryptographic login program vulnerability was not applied to one of their Unix servers.  Crackers broke into the server and later retrieved database information.  Included in the theft of data was customer information from orders and student information from chat room questionnaires.  Items such as customer credit card numbers, addresses, names, student identifications, and hobbies where stolen.  This information was later posted on a web site to prove the intelligence of the crackers and weaknesses of public web sites.

Questions for discussion:

Who is liable for any credit card fraud that may occur as a result of the break-in?  Is it the issuer or bank?  WebsRUs?  E-kin?  Is it consumers or students themselves?  Why? 
Who is responsible for personal information of the consumers and students being spread without consent, especially when this information is used for advertising or worse yet harassment means?   


Back to:
E-Kin2: Case Study
Home