Security: WebsRUs
Background:
Over the past two years E-kins business has grown to include more than Place
University. E-Kin has contracted and built facilities near three other colleges in
surrounding states. To support these
brick-and-mortar endeavors at the same time their e-commerce business surged, E-Kin
realized they needed to build up their programming staff and hardware. They elected to out-source this portion of their
business. So they hired WebsRUs, a highly
recommended firm, utilized by other e-commerce businesses small and large that experienced
great success.
In coordination with E-kin's Promotional Marketing Manager, WebsRUs developed and operated
four sites of E-kin. E-kin and WebsRUs choose
to operate their systems on Unix servers equipped with Apache web servers and a
combination of Java, XML, HTML, and JavaScript applications. The debut of the first site followed by the
remaining three went fantastically. Within a
six-month timeframe, E-kin recuperated the original cost of development. Sales started steady and picked up dramatically
when students got word of the E-kin site. On
each site, they built chat rooms for students and their particular hobbies and interests.
As long as students provided their student identifications, they could enter.
Two of E-kin sites were particularly successful and consumed sixty percent of their
business. Students flocked to these sites
since WebsRUs and E-kin made a strident effort to update the web design to reflect the new
designs of their merchandise.
Scenario:
Despite high security measures taken by WebsRUs, a patch needed to correct an SSH
cryptographic login program vulnerability was not applied to one of their Unix servers. Crackers broke into the server and later retrieved
database information. Included in the theft
of data was customer information from orders and student information from chat room
questionnaires. Items such as customer credit
card numbers, addresses, names, student identifications, and hobbies where stolen. This information was later posted on a web site to
prove the intelligence of the crackers and weaknesses of public web sites.
Questions for discussion:
Who is liable for any credit card fraud that may occur as a result of the break-in? Is it the issuer or bank? WebsRUs? E-kin? Is it consumers or students themselves? Why?
Who is responsible for personal information of the consumers and students being spread
without consent, especially when this information is used for advertising or worse yet
harassment means?
Back to:
E-Kin2: Case Study
Home