PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

344 Chapter 15 E-commerce Security Issues
diverse networks together as the Internet, security is not one of them.TCP/IP works by
chopping your data into packets and then forwarding those packets from machine to
machine until they reach their destination.This means that your data is passing through
numerous machines on the way, as illustrated in Figure 15.1. Any one of those machines
could view your data as it passes by.
Source
Destination
The Internet
Figure 15.1 Transmitting information via the Internet sends your information
via a number of potentially untrustworthy hosts.
To see the path that data takes from you to a particular machine, you can use the command
traceroute (on a Unix machine).This command gives you the addresses of the
machines that your data passes through to reach that host. For a host in your own
country, data is likely to pass through 10 different machines. For an international
machine, it may pass through more than 20 intermediaries. If your organization has a
large and complex network, your data might pass through 5 machines before it even
leaves the building.
To protect confidential information, you can encrypt it before it is sent across a network
and decrypt it at the other end.Web servers often use Secure Sockets Layer (SSL),
developed by Netscape, to accomplish this as data travels between web servers and
browsers.This is a fairly low-cost, low-effort way of securing transmissions, but because
your server needs to encrypt and decrypt data rather than simply send and receive it, the
number of visitors per second that a machine can serve drops dramatically.
Loss or Destruction of Data
Losing data can be more costly for you than having it revealed. If you have spent months
building up your site, gathering user data and orders, how much would it cost you in
time, reputation, and dollars to lose all that information? If you had no backups of any of
your data, you would need to rewrite the website in a hurry and start from scratch.You
would also have dissatisfied customers and fraudsters claiming that they ordered something
that never arrived.