Chapter 6 E-Commerce Security（课件）《电子商务专业英语》（中国水利电力出版社）

1 An English Course for E-Commerce (The Second Edition) Chapter 6 E-Commerce Security Chapter 6 E-Commerce Security 电子商务专业英语 6-2 Key points: useful terms and basic security issues Difficult points: describing major technologies for securing EC communications and networks components Chapter 6 E-Commerce Security 2 电子商务专业英语 6-3 Requirements: 1. Basic security issues 2. Types of threats and attacks 3. Managing EC security 5. 掌握复杂定语(从句)的翻译技巧 4. Major technologies for securing EC communications and networks components Chapter 6 E-Commerce Security 电子商务专业英语 6-4 6.1 Security Is Everyone’s Business New Words & Expressions: underlie vt. 位于或存在于(某物)之下, 构成…的基础(或起因); 引起 intrusion n. 闯入; 打扰 attack n. v. 攻击, 袭击 vulnerable adj. 易受伤的, 脆弱的 hacker n. 电脑“黑客 spy n. 间谍 corporate adj.社团的, 法人的 insider n. 知情人 take advantage of v.利用 perpetrator n. 犯罪者,作恶者 deter vt. 阻止; 制止 detect vt. 发现; 发觉, 查明 spending n. 开销,花费 Chapter 6 E-Commerce Security 电子商务专业英语 6-5 As the technology underlying e-commerce has become more complex, the opportunities for intrusion and attack have increased. Not only are the underlying components more vulnerable, they are also harder to administer. Teenage hackers, industrial spies, corporate insiders, agents of foreign governments, and criminal elements have all taken advantage of the situation. The variety of potential perpetrators makes it hard to deter potential attacks and detect them once they have occurred. 随着构成电子商务的技术越来越复杂，其遭受攻击的几率也在增加。技术部分不仅脆弱，而且还难于管理。十几岁的电脑黑客、行业间谍、公司内部知情人、国外政府机构和犯罪团体都在利用这种情况来实施攻击。潜在犯罪者的多样化使得阻止和检测攻击变得困难。 6.1 Security Is Everyone’s Business Chapter 6 E-Commerce Security 电子商务专业英语 6-6 According to International Data Corporation(IDC), worldwide spending on corporate digital security was over $70 billion in 2003, including costs associated with people, products and services. Although spending on security has increased significantly, the average company still spends very little of its IT budget on security and very little per employee. 据国际数据公司（IDC）称，2003年全世界公司在数字化安全方面的花费超过700亿，包括人力、产品和服务的相关成本。虽然在安全方面的花费增长显著，但每个公司也只是从其IT预算中拿出很少的部分花在安全方面，而分摊到每个员工身上的就更少了。 6.1 Security Is Everyone’s Business Chapter 6 E-Commerce Security 电子商务专业英语 6-7 New Words & Expressions: authentication n. 证明,认证 fraudulent adj. 欺骗的, 不诚实的 file v. 提交，把…归档 n. 文件 tax return 纳税申报单 authority n. 权力, 当局 entity n.实体 verify vt. 证实, 核实 credentials n.资格证书; 国书 Authorization n. 授权,认可 registry n. 档案室; 登记簿存放处 associated with 与…交往, 联系 privilege n. 特权 vt. 给与...特权 reconstruct vt. 重建，重现, 重整 confidentiality n. 机密性 privacy n. 私事, 隐私 sensitive adj. 敏感的, 灵敏的 disclose vt. 揭露, 揭开 unauthorized adj. 未被授权的 intertwined v. 缠结在一起 notion n. 概念, 观念 encryption n. 加密 availability n. 可用性,有效性 nonrepudiation n. 不可抵赖性, 非否认性 mail-order adj. 邮购的 dispute v. & n. 辩论; 争论 veracity n. 诚实; 真实 refute vt. 驳斥, 驳倒 legitimate adj. 合情合理的; 合法的 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-8 The following list summarizes some of the major security issues that can occur in EC: Authentication. When a person views a Web page from a Web site, how can they be sure that the site is not fraudulent? If a person files a tax return electronically, how do they know that is has been sent to the taxing authority? If a person receives an e-mail, how can they be sure that the sender is who they claim to be? The process by which one entity verifies that another entity is who they claim to be is called authentication. Authentication requires evidence in the form of credentials, which can take a variety of forms, including something known (e.g., a password), something unique (e.g., a signature). 以下总结了在电子商务中出现的主要安全问题： 认证 当用户浏览网站的网页时，他们如何确定这个网站不是欺骗性的呢？如果一个人提交了电子纳税申报单，纳税人如何知道它已经被提交给税务当局？如果一个人收到了一封电子邮件，他如何知道发件人就是其声明的那个人呢？一个实体证实另一实体身份与其所声明身份是否一致的过程称为认证。认证要求以证书的形式来提供证据，其形式可以多样，包括常见的形式（如密码），不常见的形式（如签名）。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-9 Authorization. Once authenticated, does a person or program have the right to access particular data, programs, or system resources (e.g., files, registries, directories, etc.)? Authorization ensures that a person or program has the right to access certain resources. It is usually determined by comparing information about the person or program with access control information associated with the resource being accessed. 授权 一旦通过认证，那么用户或程序就能够有权访问特殊数据、程序或资源（如文件、档案、目录等）了吗？授权确保了用户或程序有权访问特定的资源。通常是通过对比个人或程序的信息与要访问资源的访问控制信息来决定是否具有这种权限。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-10 Auditing. If a person or program accesses a Web site, various pieces of information are noted in a log file. If a person or program queries a database, the action is also noted in a log file. The process of collecting information about accessing particular resources, using particular privileges, or performing other security actions (either successfully or unsuccessfully ) is known as auditing. Audits provide the means to reconstruct the specific actions that were taken and often enable IT personnel to identify the person or program that performed the actions. 审核 如果用户或程序访问了某个网站，各种信息都会记录在日志文件中。如果用户或程序查询数据库，这个活动也被记入日志文件中。收集访问特定资源、使用特定权限或者执行其他安全活动（无论成功与否）的信息的过程称为审核。审核提供了重现所执行的特定活动的方法，使IT人员能识别执行这些活动的人或程序。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-11 Confidentiality (privacy). The idea behind confidentiality is that information that is private or sensitive should not be disclosed to unauthorized individuals, entities, or computer software processes. It is intertwined with the notion of digital privacy, which is now a regulatory issue in many countries. Some examples of things that should be confidential are trade secrets, business plans, health records, credit card numbers, and even the fact that a person visited a particular Web site. Confidentiality requires that we know what data or applications we want to protect and who should have access to them. Confidentiality is usually ensured by encryption. 保密性 保密性是指私人或敏感信息不能向未授权的个人、实体或计算机软件处理系统透露。这和许多国家已经形成的条例——数字化隐私的含义类似。例如商业秘密、企业计划、健康记录、信用卡账号、甚至是个人所浏览的网站都应该是保密的。保密性要求我们知道我们要保护什么数据和应用，谁有权访问它们。保密性通常通过加密来实现。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-12 Integrity. Data can be altered or destroyed while it is in transit or after it is stored. The ability to protect data from being altered or destroyed in an unauthorized or accidental manner is called integrity. Financial transactions are one example of data whose integrity needs to be secured. Again, encryption is one way of ensuring integrity of data while it is in transit. 完整性 数据在传输过程或存储之后有可能被修改或毁灭。保护数据在未授权或突发状况中不被修改或破坏的能力称为完整性。金融交易就是完整性需要确保的一个例子。数据在传输过程中，加密是保证其完整性的一种方法。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-13 Availability. If a person is trying to execute a stock trade through an online service, then the service needs to be available in near-real time. An online site is available if a person or program can gain access to the pages, data, or services provided by the site when they are needed. Technologies such as load-balancing hardware and software are aimed at ensuring availability. 可用性 如果用户试图通过在线服务来实现股票交易，那么这个服务需要有实时监测的能力。如果用户或程序在需要数据时就可以访问网页、数据或服务，那么这个在线网站就是“可用的”。负载平衡软、硬件就是保证可用性的一种技术。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-14 Nonrepudiation. If a person orders an item through a mail-order catalog and pays by check, then it is difficult to dispute the veracity of the order. If the same item is ordered through the company’s “1-800” number and the person pays by credit card, then there is always room for dispute. Similarly, if a person uses the company’s Web site and pays by credit card, the person can always claim that they did not place the order. Nonrepudiation is the ability to limit parties from refuting that a legitimate transaction took place. One of the keys to nonrepudiation is a “signature” that makes it difficult for a person to dispute that they were involved in an exchange. 不可否认性 如果用户通过邮购目录订购了某项产品，并用支票支付，那么就很难质疑订单的真实性。同样的操作通过编号为“1-800” 公司来订购，并且用信用卡支付，那么就有可质疑的空间了。相似地，如果用户使用公司的网站，并通过信用卡支付货款，这个人总会声明自己并没有下订单。不可否认性就是限制合法交易被拒绝的能力。不可否认性的关键之一就是签名，这使个人很难否认他们确实进行了交易。 6.2 Basic Security Issues Chapter 6 E-Commerce Security 电子商务专业英语 6-15 New Words & Expressions: distinguish v. 辨别, 区别 nontechnical n. 非技术性的 chicanery n. 哄骗; 欺骗 trick into诱骗…使之采取… reveal vt. 显示; 露出 compromise n. 妥协 vi. 折中解决 vt. 危害 innocuous adj.无害的, 不会招致反对的 inadvertently adv. 不注意地 attempt vt. n. 试图; 尝试 desire vt. n. 希望, 渴望 rest with在于, 取决于 victim n. 牺牲者, 受害者, 受灾者 combat n.战斗,斗争vt. 与…战斗 frequent adj. 常见的vt. 光顾, 常与…交往 in contrast to相比之下 methodical adj. 有条理的, 井然的 expertise n. 专门知识或技能 novice n. 新手, 初学者 confine vt. 限制; 局限于；n. 界限, 范围 distributed adj. 分布式的 malicious adj. 恶意的, 恶毒的 a flood of一大批 packet n. 小包 overloading vt. 使超载, 使过载 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-16 New Words & Expressions: legitimate adj. 合情合理的; 合法的 overwhelm vt. 覆盖, 淹没 magnitude n. 巨大; 重要性 halt n. 停住, 停止, 暂停v. (使)停下来 zombie n. 傀儡 行尸走肉 modem n. 调制解调器 candidate n. 申请求职者, 候选人 script n. 剧本, 脚本, 讲稿 on sb.‘s hands 由某人负责 mount v. 登上; 发动攻击; 攻击n. 山峰 propagate v. 繁衍, 增殖 vt. 传播; 宣传, 普及 benign adj. 善良的, 温和的 potential adj. 潜在的, 有可能的n. 潜力, 可能性 hybrid n. 杂种, 混血儿 pathogen n. 病菌,病原体 resemble vt. 像…, 类似于 payload n. 有效载荷 trigger n. (枪)扳机vt. 引发 substantial adj. 重大的, 实质的 worm n. 虫; 蠕虫 macro n. 宏adj. 巨大的 unsuspecting adj. 不怀疑的, 可信任的 Trojan horse n. 〈希神〉特洛伊木马 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-17 6.3 Types of Threats and Attacks Abbreviations: DDoS (distributed denial of service) 分布式拒绝服务 DoS (denial-of –service) 拒绝服务 Malware (malicious software) 恶意软件 RFC (Request for Comment) 请求注解 Chapter 6 E-Commerce Security 电子商务专业英语 6-18 Security experts distinguish between two types of attacks—nontechnical and technical. Nontechnical attacks are those in which a perpetrator uses chicanery or other forms of persuasion to trick people into revealing sensitive information or performing actions that can be used to compromise the security of a network. These attacks are also called social engineering attacks. 安全专家将攻击分为两类——非技术型和技术型。非技术型攻击是指犯罪者使用哄骗或者其他的诱惑方法来使人们暴露敏感信息或执行有害于网络安全的操作。这些攻击也被称为社会工程攻击。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-19 6.3.1 Nontechnical Attacks: Social Engineering In social engineering, individual users are tricked by social pressures into providing information or carrying out actions that they feel are innocuous but that inadvertently support hackers in their attempts to attack and compromise the networks to which those individuals have access. Social engineering preys on an individual’s desire to help, an individual’s fear of getting into trouble, or the general trust among individuals. 6.3.1非技术型攻击：社会工程攻击 在社会工程中，一些社会压力诱使个人用户提供信息或执行看似无害的活动，而这些无意中又帮助了黑客去攻击和损害用户所访问的网络。社会工程攻击利用人们希望得到帮助、害怕陷入困境的心理或人们之间普遍的信任来进行攻击。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-20 Because the key to successful social engineering rests with the victims, the key to combating social engineering attacks also rests with the victims. Certain positions within an organization are clearly more vulnerable than others. These are the individuals who have access to private and confidential information and interact with the public on a frequent basis. Some of the positions with this sort of access and contact are secretaries and executive assistants, database and network administrators, computer operators, call-center operators, and help-desk attendants. 由于成功进行社会工程攻击的关键取决于受害者，因此战胜这种攻击的关键也是受害者。组织内部的某些职位比其他的职位更易遭受攻击。这些职位的人员一般有权访问私人信息和保密信息，并且和外界联系频繁。这些职位包括秘书、经理助理、数据库和网络管理员、计算机操作员、呼叫中心接线员和客户服务人员。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-21 6.3.2 Technical Attacks In contrast to nontechnical attacks, software and systems knowledge are used to perpetrate technical attacks. In conducting a technical attack, an expert hacker often uses a methodical approach. Several software tools are readily and freely available over the Internet that enable a hacker to expose a system’s vulnerabilities. Although many of these tools require expertise, novice hackers can easily use many of the existing tools. 6.3.2技术型攻击 和非技术型攻击不同，技术型攻击使用软件和系统知识去实施攻击。在进行技术型攻击时，专业的黑客常常运用系统的方法。准备好运用于网络上的几个软件工具就可以使黑客看到系统的弱点。虽然很多软件要求具有专业知识的人员进行操作，但初级黑客也能够很容易地使用这些工具。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-22 We will confine our discussion to two types of attacks that are well known and that have affected the lives of millions——distributed denial of service(DDoS) attacks and malicious code attacks (viruses, worms, and Trojan horses). 我们将集中讨论两类常见的、并且已经影响到了数百万人生活的攻击——分布式拒绝服务攻击和恶意代码攻击（病毒、蠕虫和特洛伊木马）。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-23 1. Distributed Denial of Service Attacks In a denial-of –service (DoS) attack, an attacker uses specialized software to send a flood of data packets to the target computer, with the aim of overloading it’s resources. Many attackers rely on software that has been created by other hackers and made available over the Internet rather than developing it themselves. 1. 分布式拒绝服务攻击 在分布式拒绝服务攻击中，攻击者利用特殊软件向目标计算机发送大量的数据包，以使其资源超负荷。许多攻击者依赖于其他黑客开发的软件而不是自己开发软件，并通过因特网使它们发挥作用。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-24 With a distributed denial of service(DDoS) attack, the attacker gains illegal administrative access to as many computers on the Internet as possible. Once an attacker has access to a large number of computers, they load the specialized DDoS software onto these computers. The software lays in wait, listening for a command to begin the attack. When the command is given, the distributed network of computers begins sending out requests to the target computer. The requests can be legitimate queries for information or can be very specialized computer commands designed to overwhelm specific computer resources. There are different types of DDoS attacks. In the simplest case, it is the magnitude of the requests that brings the target computer to a halt. 攻击者实施分布式拒绝服务攻击可以获得非法的访问权限以进入因特网上尽可能多的计算机。一旦攻击者进入到大量的计算机中，就在这些计算机中加载特殊的DDoS软件。这些软件处于待命状态，以等待攻击命令。当发出攻击命令时，计算机网络向目标计算机发送大量的请求。这些请求可以是合法的信息咨询或者是设计用来覆盖特定计算机资源的特殊计算机命令。有多种不同的DDoS攻击。最简单的情况是，利用大量的请求信息使目标计算机瘫痪。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-25 The machines on which the DDoS software is loaded are known as zombies. Zombies are often located at university and government sites. Increasingly, with the rise of cable modems and DSL modems, home computers that are connected to the Internet and left on all the time have become good zombie candidates. 安装有DDoS软件的计算机称为傀儡。傀儡经常位于高校或政府部门。随着电缆调制解调器和DLS调制解调器的兴起，接入因特网并始终在线的个人计算机成为了傀儡的候选者。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-26 Due to the widespread availability of free intrusion tools and scripts and the overall interconnectivity on the Internet, virtually anyone with minimal computer experience (often a teenager with time on his hands) can mount a DoS attack. 由于网络上许多入侵工具和脚本是免费的，而且因特网的广泛互联，使得事实上只要有点计算机经验的人（通常十几岁的孩子）都能制造DoS攻击。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-27 2. Malicious Code: Viruses, Worms, and Trojan Horses Sometimes referred to as malware (for malicious software), malicious code is classified by the way in which it is propagated. Some malicious code is rather benign, but it all has the potential to do damage. 2. 恶意代码：病毒、蠕虫与特洛伊木马 有时，恶意代码也被称为恶意软件，这种代码是根据其传播途径分类的。有的恶意代码是良性的，但它们也具有潜在的破坏性。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-28 Malicious code takes a variety of forms——both pure and hybrid. The names of such code are taken from the real-word pathogens they resemble. (1) Viruses This is the best known of the malicious code categories. Although there are many definitions of a computer virus, the Request for Comment (RFC) 1135 definition is widely used:“ A virus is a piece of code that inserts itself into a host, including the operating systems, to propagate. It cannot run independently. It requires that its host program be run to activate it.” 恶意代码有各种形式——有纯种的和变种的。它们的名字来自于现实世界与之相似的病原体。 (1) 病毒 病毒是恶意代码最广为人知的形式。虽然关于计算机病毒的定义有很多，但请求注解(RFC)1135的定义是最常被使用的：“病毒是一段代码，它被植入主机，包括操作系统，从而进行传播。它不能独立运行。它要求主机程序运行以激活它”。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-29 A virus has two components. First, it has a propagation mechanism by which it spreads. Second, it has a payload that refers to what the virus does once it is executed. Sometimes the execution is triggered by a particular event. The Michelangelo virus, for instance, was triggered by Michelangelo’s birth date. Some viruses simply infect and spread. Others do substantial damage (e.g., deleting files or corrupting the hard drive). 病毒有两个组成部分：其一，有一种繁殖机制使其能够传播；其二，有一种有效载荷，一旦它被执行，就会执行相应的破坏活动。有时某些特殊的事件就能触发病毒的执行。例如，米开朗基罗病毒就是在米开朗基罗的生日那天被将激活的。有些病毒只是简单的传染和蔓延。而另外一些的病毒则会造成重大的危害（如删除文件或破坏硬盘驱动器）。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-30 (2) Worms The major difference between a worm and a virus is that a worm propagates between systems (usually through a network), whereas a virus propagates locally. RFC1135defines a worm in this way:“ A worm is a program that can run independently, will consume the resources of its host from within in order to maintain itself, and can propagate a complete working version of itself onto another machine. ” (2) 蠕虫 蠕虫和病毒的主要区别是蠕虫在系统之间传播（通常是通过网络），而病毒是在本地计算机上传播。RFC1135给出了蠕虫的定义：“蠕虫是可以独立运行的程序，为了维护自身，它会消耗主机资源，并能复制一个自身的完整工作版本到另一台计算机上。” 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-31 (3) Macro viruses and macro worms A macro virus or macro worm is usually executed when the application object (e.g., spreadsheet, word processing document, e-mail message) containing the macro is opened or a particular procedure is executed (e.g., a file is saved). Melissa and ILOVEYOU were both examples of macro worms that were propagated through Microsoft Outlook e-mail and whose payloads were delivered as a Visual Basic for Application (VBA) programs attached to e-mail messages. When the unsuspecting recipient opened the e-mail, the VBA program looked up the entries in the recipient’s Outlook address book and sent copies of itself to the contacts in the address book. If you think this is a difficult task, note that the ILOVEYOU macro was about 40 lines of code. (3) 宏病毒和宏蠕虫 宏病毒或宏蠕虫通常是在打开含有宏的对象（如表单、word文档、电子邮件）或执行特殊的过程（如文件保存）时被激活的。Melissa和ILOVEYOU是宏蠕虫的两个典型代表，它们通过微软的Outlook传播，其载荷以附加在电子邮件中的VBA代码形式传播。当毫无戒心的接收者打开邮件时，VBA程序将寻找接收者的Outlook地址薄的入口，然后向该地址薄中的联系人发送自身的副本。如果你认为这是一个困难的任务，请注意ILOVEYOU宏只有大约40行代码。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-32 (4) Trojan horses A Trojan horse is a program that appears to have a useful function but contains a hidden function that presents a security risk. (4) 特洛伊木马 特洛伊木马似乎是一种有用的程序，但却包含了隐藏的功能，威胁了计算机的安全。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-33 There are many types of Trojan horse programs. The programs of interest are those that make it possible for someone else to access and control a person’s computer over the Internet. This type of Trojan horse has two parts: server and client. The server is the program that runs on the computer under attack. The client program is the program used by the person perpetrating the attack. For example, the Girlfriend Trojan is a server program that arrives in the form of a file that looks like an interesting game or program. When the unsuspecting user runs the program, the Trojan program is installed. The installed program is executed every time the attacked computer is turned on. The server simply waits for the associated client program to send a command. This particular Trojan horse enables the perpetrator to capture user IDs and passwords, to display messages on the affected computer, to delete and upload files, and so on. 有许多类型的特洛伊木马程序。其中的一种程序可以通过因特网来访问或控制一个人的计算机。这种类型的特洛伊木马由两部分构成：服务器和客户端。服务器是一个运行在被攻击计算机上的程序。客户端程序由实施攻击的人来使用。例如，女友木马是服务器端程序，以文件的形式到达被攻击的计算机上，它看起来像个有趣的游戏或程序。当毫无戒心的用户运行这个程序时，木马程序即会被安装。被攻击的计算机每次开机，该程序就会被执行一次。服务器端程序只是简单地等待相应的客户端程序发送命令。这种特殊的特洛伊木马使得黑客可以获取用户的账号和密码、在感染的计算机上显示某些信息、删除和上传文件，等等。 6.3 Types of Threats and Attacks Chapter 6 E-Commerce Security 电子商务专业英语 6-34 6.4 Managing EC Security New Words & Expressions: undervalued adj. 售价过低的 proactive adj. 前摄的 dated adj. 有日期的,陈旧的 lack of缺乏 holistic adj. 整体的,全盘的 articulate adj. 表达能力强的v.清楚地表达 honeynet蜜网 honeypot蜜罐 tolerable adj. 可忍受的 deem vt.认为, 相信 counter n. 柜台, 计数器v.对抗, 反驳 ongoing adj. 继续进行的; 不断前进[发展]中的 Chapter 6 E-Commerce Security 电子商务专业英语 6-35 Although awareness of security issues has increased in recent years, organizations continue to make some fairly common mistakes in managing their security risks (McConnell 2002): Undervalued information. Few organizations have a clear understanding of the value of specific information assets. 虽然近些年来人们已经逐步意识到了安全问题，但一些机构依然在应对安全风险上犯一些错误(McConnell 2002): 信息价值被低估。 很少有组织清楚地了解特定信息资产的价值 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-36 Narrowly defined security boundaries. Most organizations focus on securing their internal networks and fail to understand the security practices of their supply chain partners. Reactive security management. Many organizations are reactive rather than proactive focusing on security after an incident or problem occurs. 安全边界的定义过于狭窄。大多数的组织专注于他们内部网络的安全，而忽视了他们供应链条上合作伙伴的安全。 事后安全管理。许多组织是在事故或问题发生后才重视安全问题，而不是在事前就进行安全管理。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-37 Dated security management processes. Organizations rarely update or change their security practice to meet changing needs. Similarly, they rarely update the knowledge and skills of their staff about best practices in information security. Lack of communication about security responsibilities. Security often is viewed as an IT problem, not an organizational one. 过时的安全管理程序。很少有组织更新或改变他们的安全惯例以满足变化的需要。同样，他们也很少更新员工在信息安全方面的知识和技能。 缺乏有关安全责任的沟通。安全常被视为IT问题，而不是组织问题。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-38 Given these common mistakes, it is clear that a holistic approach is required to secure an EC site. Sites must constantly evaluate and address emerging vulnerabilities and threats. End users must recognize that IT security is as important as physical security and must adopt responsible behavior. Senior management must articulate the need for IT security, play a key role in formulating organizational security policies, and actively support those policies. Those organizations with sound security practices rely on comprehensive risk management to determine their security needs (King 2001; Power 2000). 有了以上这些普遍存在的错误，很明显电子商务网站的安全需要一个整体的解决方案。企业必须经常地评估和重视网站上出现的弱点和威胁。终端用户必须认识到IT安全和实际的安全是同等重要的。高级管理层必须对IT安全的需求阐述清楚，充当明确叙述组织安全策略的关键角色，并积极支持这些策略。那些具有健全安全条例的组织凭借综合的风险管理可以满足他们安全上的需要。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-39 SECURITY RISK MANAGEMENT Security risk management is a systematic process for determining the likelihood of various security attacks and for identifying the actions needed to prevent or otherwise mitigate those attacks. It consists of four phases: 安全风险管理 对于确定各种安全攻击的可能性和识别需要防范或减弱攻击来说，安全风险管理是一个系统过程。它包含四个阶段： 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-40 Assessment. In this phase, organizations evaluate their security risks by determining their assets, the vulnerabilities of their system, and the potential threats to these vulnerabilities. One way to evaluate the vulnerabilities and threats facing a specific organization is to rely on the knowledge of the organization’s IT personnel or to use outside consultants to make the determination. Another way is to utilize a honeynet to study the types of attacks to which a site is being actively subjected. A honeynet is a network of honeypots, which are production systems (firewalls, routers, Web servers, database servers, and the like) that can be watched and studied as network intrusions occur. 评估。在这个阶段中，组织通过确定他们的资产、系统的漏洞和对于这些漏洞而言潜在的威胁来评价其安全风险。评估特定组织所面临的威胁和漏洞的一种办法是凭借组织IT人员的知识或使用外界的顾问。另一种办法是利用蜜网来研究网站正在主动制伏的攻击的类型。蜜网是蜜罐网络，当网络攻击发生时，蜜罐是可以被观察和研究的产品体系（防火墙，路由器，Web服务器，数据库服务器等）。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-41 Planning. The goal of this phase is to arrive at a set of policies defining which threats are tolerable and which are not. A threat is deemed tolerable if the cost of the safeguard is too high or the risk too low. The policies also specify the general measures to be taken against those threats that are intolerable or high priority. 计划。该阶段的目标是达成一套策略以确定哪些威胁是可忍受的，哪些是不可忍受的。如果防护措施的成本太高或风险很低，这种威胁就是可忍受的。策略也定义了防范不可忍受或高优先级的威胁的常用措施。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-42 Implementation. During implementation, particular technologies are chosen to counter high-priority threats. The selection of particular technologies is based on the general guidelines established in the planning phase. As a first step in the implementation phase, generic types of technology should be selected for each of the high priority threats. Given the generic types, particular software from particular vendors can then be selected. 实施。在实施阶段中，选择特殊的技术来对抗高优先级的威胁。特殊技术要根据计划阶段所建立的总的指导方针来进行选择。实施阶段中的第一步是为每一个高优先级的威胁选择所属的技术类型。有了这些所属类型，就可以从特殊厂商购买特殊的软件。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-43 Monitoring. This is an ongoing process that is used to determine which measures are successful, which measures are unsuccessful and need modification, whether there are any new types of threats, whether there have been advances or changes in technology, and whether there are any new business assets that need to be secured. 监测。这是一个持续进行的过程，用来判断哪些措施是成功的，哪些是不成功需要改进的，而无论是否有新类型的威胁产生、是否在技术上有改进或改变，是否有新的企业资产需要保护。 6.4 Managing EC Security Chapter 6 E-Commerce Security 电子商务专业英语 6-44 6.5 Securing EC Communications New Words & Expressions: token n. 象征，代币 passive adj. 被动的; 消极的 magnetic strip 磁条 swipe n. v. 重击, 挥击 biometric生物识别技术 fingerprint n. 指纹 iris n. 虹膜 physiological adj. 生理的，生理学的 discontinuity n.断绝,不连续,中断 ridge n. 脊, 山脊 tip n. 尖端, 末端 pond n. 池塘，槽 template n. 模板 pupil n. 学生, 瞳孔 identical adj. 同一的 acoustical adj. 听觉的,声学的 assumption n. 假定, 臆断 variability n. 可变性 state of the art n. 技术发展水平 cornerstone n. 奠基石 e-payment电子支付 encryption n. 加密 scramble vt. 混杂; 把…搅乱 decrypt v. 解密 plaintext n. 明码文本 ciphertext n. 密码,暗记文 symmetric adj. 相称性的,均衡的 asymmetric adj.不均匀的,不对称的 forge v. 伪造, 仿造 repudiate vt.拒绝接受, 否认, 否定 notarize vt. 证明,确认 confidentiality n. 机密性 de facto adj. 〈拉〉实际上存在的in the case of 至于…, 就…来说 Chapter 6 E-Commerce Security 电子商务专业英语 6-45 Abbreviations: PKI (public key infrastructure) 公钥基础设施 DES (Data Encryption Standard) 数据加密标准 CA (certificate authority) 认证中心 SSL (Secure Socket Layer) 安全套接层 TLS (Transport Layer Security) 传输层安全 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-46 As the CERT/FBI survey indicates, most organizations rely on multiple technologies to secure their networks. The technologies can be divided into two major groups: those designed to secure communications across the network and those designed to protect the servers and clients on the network. This section considers the first of these technologies. 正如CERT/FBI调查表明的那样，大多数的组织凭借多种技术来保证他们网络的安全。这些技术可以被分成两种：一种是用来保护网络的通信安全，一种是用来保护网络上的服务器和客户机的安全。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-47 6.5.1 Authentication Stronger security is achieved by combining something one knows with something one has, a technique known as two-factor authentication. Tokens qualify as something one has. Tokens come in various shapes, forms, and sizes. Passive tokens are storage devices containing a secret code. The most common passive tokens are plastic cards with magnetic strips containing a hidden code. With passive tokens, the user swipes the token through a reader attached to a personal computer or workstation and then enters their password in order to gain access to the network. 6.5.1 身份认证 通过将某人所了解的信息和它所有物相结合可以达到较强的安全性。这就是被称为双因素身份认证的技术。证书资格可以作为某人的所有物。证书可以有各种形状、形式和大小。被动证书是包含有密码的存储设备。最常见的被动证书是带有隐藏密码磁条的塑料卡。用户将被动证书插入连接到个人计算机或工作站的读卡器中，然后输入密码，就可以访问网络了。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-48 Active tokens are usually small stand-alone electronic devices that generate one-time passwords. In this case, the user enters a PIN into the token, the token generates a password that is only good for a single log-on, and the user then logs on to the system using the one-time password. ActiveCard and Cryptocard are companies that provide active token authentication devices. 主动证书通常是能够生成一次性密码的小的单机电子设备。在这种情况下，用户将个人身份号码输入证书，证书就生成只对一次登录有效的密码，然后用户使用这个一次性密码登录到系统中。ActiveCard和Cryptocard公司就生产这种主动认证设备。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-49 Biometric System Two-factor authentication can also be based on something one is. Fingerprint scanners, iris scanners, facial recognition systems, and voice recognition are all examples of biometric systems that identify a person by something they have. 生物特征识别系统 双因素身份认证也可以基于某人本身。指纹扫描器、虹膜扫描器、面部特征识别系统和语音识别都是生物特征识别系统的代表。这些系统可以通过人们身体的特征来实现对人的识别。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-50 Biometrics come in two “flavors”—physiological and behavioral. Physiological biometrics are based on measurements derived directly from different parts of the body (e.g., scans of fingerprints, the iris, hand geometry, and facial characteristics). In contrast, behavioral biometrics are derived from various actions and indirectly from various body parts (e.g., voice scans or keystroke monitoring ). 生物特征识别有两种来源——生理特征和行为特征。生理特征识别技术基于直接对身体不同部位的测量（如扫描指纹、虹膜、手形和面部特征）；相比之下，行为特征识别技术则是基于各种行为和间接基于身体各部位（如语音扫描或按键监控）。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-51 In practice, physiological biometrics are used more often than behavioral biometrics. Among the physiological biometrics, the scans of fingerprints, iris scans, hand geometry, and facial characteristics are the most popular. 在实际应用中，生理特征识别比行为特征识别更加常见。在生理特征识别技术中，指纹扫描、虹膜扫描和面部特征识别最为常用。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-52 Fingerprint scanning. Fingerprints can be distinguished by a variety of “discontinuities that interrupt the smooth flow of ridges” (Keroeker 2002) on the bottom tips of the fingers. Ridge endings, dots (small ridges), and ponds (spaces between ridges) are examples of such discontinuities. In fingerprint scanning, a special algorithm is used to convert the scanned discontinuities to a set of numbers stored as a template. The chance that any two people have the same template is one in a billion. 指纹扫描 指纹以指尖底部不同的“中断了平滑褶皱流的不连贯物” (Keroeker 2002)为特征。褶皱末端、点和槽（褶皱之间的空隙）是这种不连贯物的代表。在指纹扫描中，使用特殊的算法来将扫描的不连贯物转换成一组数据以用作模板。两个人有相同模板的机率是十亿分之一。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-53 Iris scanning. The iris is the colored part of the eye surrounding the pupil. The iris has a large number of unique spots that can be captured by a cameral that is placed 3 to 10 inches from the eye. Within a second, a special algorithm can convert the iris scan to a set of numbers. The numbers can be used to construct an iris-scan template that can be used in iris scanning, in which a camera scans a person’s iris, compares the scan to a template, and verifies the person’s identity. The chance that any two people have identical iris templates is considerably smaller that the chance that they have the same fingerprint templates. 虹膜扫描 虹膜是围绕在瞳孔周围的彩色部分。虹膜有大量特有的斑点，这些斑点可以被放置在距离眼球3到10英寸处的照相机捕捉到。一种特殊的算法可以在一秒钟内将虹膜扫描结果转换成一组数据。这些数据被用来创建虹膜扫描模板，在虹膜扫描中，照相机将扫描的结果和模板数据进行比较以确认人们的身份。任何两个人具有相同虹膜模板的机率小于他们拥有相同指纹模板的机率。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-54 Voice scanning. Differences in the physiology of speech production from one individual to the next produce different acoustical patterns that can be converted into a template used in voice scanning. In most voice-scanning systems, the user talks into a microphone or telephone. The word that is spoken is usually the user’s system ID or password. The next time a user wants to gain access to a system, the user simply repeats the spoken word. It takes about 4 to 6 seconds to verify a voice scan. 语音扫描 不同的两个人所发出的声音在生理特征方面的不同会产生不同的声音模式，这种声音模式可以被转换为模板应用在语音扫描中。在大多数的语音扫描系统中，用户对着麦克风或电话说话，说话的内容通常是用户的系统账号或密码。如果用户想要再次访问系统，只需要重复这些内容。验证语言扫描需要花费4到6秒的时间。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-55 Keystroke monitoring. This biometric is still under development. Keystroke monitoring is based on the assumption that the way in which users type words at a keyboard varies from one user to the next. The pressure, speed, and rhythm with which a word is entered are converted through a special algorithm to a set of numbers to form a keystroke template. Again, the word that is employed in most of these systems is the user’s system ID or password. When a user wants to gain access to a system, the user simply types in their system ID or password. The system checks the pressure, speed, and rhythm with which the word is typed against the templates in the database. The main problem with these systems is that there is still too much variability in the way an individual types from one session to the next. 按键监控 这种生物技术还在发展中。按键监控是基于一种假设，即假定不同的用户键入单词的方式不同。键入单词的压力、速度和节奏通过一种特殊的算法被转化为一组数据，用以建立按键模板。而且，大多数这种系统用到的单词是用户的系统账号和密码。当用户想要访问系统时， 用户只要简单地敲入他们的系统账号和密码即可。系统会检查敲击的压力、速度和节奏，以和数据库中的模板进行比较。这种系统的主要问题是，用户在不同时期按键方式本身也有太多的可变性。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-56 6.5.2 Public key infrastructure The “state of the art” in authentication rests on the public key infrastructure (PKI). PKI has become the cornerstone for secure e-payments. It refers to the technical components, infrastructure, and practices needed to enable the use of public key encryption, digital signatures, and digital certificates with a network application. PKI is also the foundation of a number of network applications, including SCM, VPNs, secure e-mail, and intranet applications. 6.5.2 公钥基础设施 认证的技术发展水平依赖于公钥基础设施（PKI）。PKI已经成为安全电子支付的奠基石。PKI指的是技术组件、基础设施和应用，这些应用可以使网络应用所必须的公钥加密、数字签名和数字证书的使用成为可能。PKI也是许多诸如SCM、VPN、安全电子邮件和内联网的网络应用的基础。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-57 (1) Private and Public Key Encryption At the heart of PKI is encryption. Encryption is the process of transforming or scrambling (encrypting) data in such a way that it is difficult, expensive, or time-consuming for an unauthorized person to unscramble (decrypt) it. All encryption has four basic parts: the plaintext, ciphertext, encryption algorithm, and the key. The two major classes of encryption systems are symmetric systems, with one secret key, and asymmetric systems, with two keys. (1) 私钥和公钥加密 PKI的核心是加密。加密是采用一种方法来改变或杂凑（加密）数据的过程，这种方法对于非授权用户来说，解密数据将是非常困难、昂贵或耗时的。加密由四个基本部分组成：明文、密文、加密算法和密钥。 主要有两类加密系统：对称系统——只有一个密钥，和非对称系统——有两个密钥。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-58 (2)Symmetric (Private) Key System In a symmetric (private) key system the same key is used to encrypt and decrypt the plaintext. The sender and receiver of the text must share the same key without revealing it to anyone else—thus making it a so-called private system. (2) 对称密钥（私钥）系统 在对称密钥（私钥）系统中，使用同样的密钥来加密和解密明文。文本的发送者和接收者共享同样的密钥，而对其他人保密——因此称为密钥系统。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-59 For years, the Data Encryption Standard (DES) was the standard symmetric encryption algorithm supported by U.S. government agencies. On October 2, 2000, the National Institute of Standards and Technology (NIST) announced that DES was being replaced by Rijndael, the new Advanced Encryption Standard used to secure U.S. government communications. 多年来，DES算法是美国政府机构支持的标准对称加密算法。2000年10月2日，国家标准与技术研究院宣告Rijndael取代了DES，成为新的高级加密标准来保护美国政府通信安全。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-60 (3)Public (Asymmetric) Key Encryption Imagine trying to use one-key encryption to buy something offered on a particular Web server. If the seller’s key were distributed to thousands of buyers, then the key would not remain secret for long. This is where public key (asymmetric) encryption comes into play. Public key encryption uses a pair of matched keys—a public key that is publicly available to anyone and a private key that is known only to its owner. If a message is encrypted with a public key, then the associated private key is required to decrypt the message. If, for example, a person wanted to send a purchase order to a company and have the contents remain private, they would encrypt the message with the company’s public key. When the company received the order, they would decrypt it with the associated private key. (3) 公钥（非对称）加密 想象使用单密钥加密来购买特定Web服务器上的物品。如果销售者的密钥分发给数千个购买者，那么密钥就不再是秘密了。这时公钥加密就起作用了。公钥加密使用一对匹配的密钥——可以公开给他人的公钥和只有拥有者才知道的私钥。如果信息用公钥加密，那么就要使用相应的私钥来解密信息。例如，如果一个人要发送订单给一个公司，并要求订单内容保密，那么他就可以使用公司的公钥来加密信息。当公司接收到订单时，就使用相关的私钥来解密信息。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-61 The most common public key encryption algorithm is RSA. RSA uses keys ranging in length from 512 bits to 1,024 bits. The main problem with public key encryption is speed. Symmetrical algorithms are significantly faster than asymmetric key algorithms. Therefore, public key encryption cannot be used effectively to encrypt and decrypt large amounts of data. In practice, a combination of symmetric and asymmetric encryption is used to encrypt messages. 最常用的公钥加密算法是RSA。RSA使用长度在512到1024位之间的密钥。公钥加密的主要问题是速度。对称加密算法比非对称算法快得多。因此，公钥加密不能有效地用于大量数据的加密。实际上，通常采用对称和非对称加密的组合来加密信息。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-62 (4)Digital Signatures In the online world, how can one be sure that a message is actually coming from the person who they think sent it? Similarly, how one be sure that a person cannot deny that they sent a particular message? (4) 数字签名 在网络世界中，人们如何确保信息确实来自于想发送消息的人呢？也就是，如何确保发送消息的人不能抵赖？ 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-63 One part of the answer is a digital signature—the electronic equivalent of a personal signature that cannot be forged. Digital signatures are based on public keys. They can be used to authenticate the identity of the sender of a message or document. They also can be used to ensure that the original content of an electronic message or document is unchanged. Digital signatures have additional benefits in the online world. They are portable, cannot be easily repudiated or imitated, and can be time-stamped. 数字签名是答案的一部分，数字签名是不可伪造的个人签名的电子等价物。数字签名是基于公钥的。数字签名用来证明消息或文档发送者的身份，同时，他们还被用来确保电子消息或文档的原始内容没有被改动。数字签名在网络上还有其他的好处。数字签名易于传输、不易否认或模仿，还可以打上时间戳。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-64 (5)Digital Certificates and Certificate Authorities If one has to know someone’s public key to send them a message, where does the public key come from and how can one be sure of the person’s actual identity? Digital certificates verify that the holder of a public and/ or private key is who they claim to be. Third parties called certificate authorities (CAs) issue digital certificates. A certificate contains things such as the holder’s name, validity period, public key information, and a signed hash of the certificate data (i.e., hashed contents of the certificate signed with the CA’s private key). Certificates are used to authenticate Web sites (site certificates), individuals (personal certificates), and software companies (software publisher certificates). (5)数字证书和认证中心 如果必须知道某人的公钥才能给他发送信息，那么公钥从何而来，如何认定那个人的真实身份呢？数字证书可以证明公钥和私钥的持有者是他所声称的那个人。被称为认证中心的第三方来签发数字证书。一份证书包含持有者的名字、有效期、公钥信息和证书数字签名的哈希数据（也就是使用认证中心的私钥签名的经过哈希算法的证书内容）。证书被用来认证Web站点（站点证书）、个人（个人证书）和软件公司（软件发布者证书）。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-65 There are a large number of third-party CAs. VeriSign (versign.com) is the best known of the CAs. VeriSign issues three classes of certificates: Class 1 verifies that an e-mail actually comes from the user’s address. Class 2 checks the user’s identity against a commercial credit database. Class 3 requires notarized documents. Companies such as Microsoft offer systems that enable companies to issue their own private, in-house certificates. 有很多第三方认证中心。VeriSign(versign.com)是最著名的的认证中心。它签发三类证书：第一类是证明电子邮件确实来自于用户的地址。第二类是在商业信用数据库中核查用户的身份。第三类是要求证明文件。像微软这样的公司提供有允许企业签发私有内部证书的系统。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-66 (6)Secure Socket Layer If the average user had to figure out how to use encryption, digital certificates, digital signature, and the like, there would be few secure transactions on the Web. Fortunately, many of these issues are handled in a transparent fashion by Web browser and Web servers. Given that different companies, financial institutions, and governments, in many countries, are involved in e-commerce, it is necessary to have generally accepted protocols for securing e-commerce. One of the major protocols in use today is Secure Socket Layer (SSL), also known as Transport Layer Security (TLS). (6) 安全套接层 如果普通的用户必须理解如何使用加密、数字证书、数字签名、等，那么在网上就不会有安全的交易了。幸运的是，很多这类的问题已经由Web浏览器和Web服务器以一种透明的方式处理了。假定许多国家的不同公司、金融机构和政府都参与到电子商务中，有必要为安全的电子商务制定广泛接受的协议。今天使用的主要协议之一是安全套接层，也称为传输层安全。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-67 The Secure Socket Layer (SSL) was invented by Netscape to utilize standard certificates for authentication and data encryption to ensure privacy or confidentiality. SSL became a de facto standard adopted by the browsers and servers provided by Microsoft and Netscape. In 1996, SSL was renamed Transport Layer Security (TLS), but many people still use the SSL name. It is the major standard used for online credit card payments. 安全套接层由网景公司发明，用来使用标准证书和数据加密来确保私密性和机密性。SSL已成为事实上的标准，微软和网景提供的浏览器和服务器采用这种标准。1996年，SSL更名为传输层安全，但许多人依然使用SSL这个名字。它是在线信用卡支付的主要标准。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-68 SSL makes it possible to encrypt credit card numbers and other transmissions between a Web server and a Web browser. In the case of credit card transactions, there is more to making a purchase on the Web than simply passing an encrypted credit card number to a merchant. The number must be checked for validity, the consumer’s bank must authorize the card, and the purchase must be processed. SSL is not designed to handle any of the steps beyond the transmission of the card number. SSL使用户在Web服务器和Web浏览器之间加密信用卡和其它传输内容成为可能。就信用卡交易来说，网上购物要比简单地传输加密过的信用卡号给零售商要复杂的多。号码必须做有效性检查，消费者的开户行必须认可这个信用卡，订单必须被处理。SSL并非设计用来处理除传输卡号之外的任何步骤。 6.5 Securing EC Communications Chapter 6 E-Commerce Security 电子商务专业英语 6-69 6.6 Securing EC Networks New Words & Expressions: segment n. 部分, 片段 packet n. 小包, 小盒 tamper vt. 窜改; 玩弄 flaw n. 缺点, 瑕疵 Abbreviations: VPN (virtual private network)虚拟专用网 IDS (intrusion detection system)入侵检测系统 Chapter 6 E-Commerce Security 电子商务专业英语 6-70 Several technologies exists that ensure that an organization’s network boundaries are secure from cyber attack or intrusion and that if the organization’s boundaries are compromised that the intrusion is detected. 一些确保组织边界安全，使其免受网络攻击或入侵以及如果组织边界遭受损害就会被检测到的技术已经出现。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-71 6.6.1 Firewalls The term firewall came into use in the 1700s to describe the gaps cut into forests so that fires could be prevented from spreading to other parts of the forest. In the world of networked computing, a firewall is a network node consisting of both hardware and software that isolates a private network form a public network. 6.6.1防火墙 防火墙这个术语在16世纪就已经出现，它是用来描述为了组织火势蔓延到森林中的其它部分而在森林中伐出的空隙。在网络计算领域中，防火墙是由硬件和软件组成的网络节点，以便使私有网络和公共网络相隔离。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-72 Some firewalls filter data and requests moving from the public Internet to a private network based on the network addresses of the computer sending or receiving the request. These firewalls are called packet-filtering routers. On the Internet, the data and requests sent from one computer to another are broken into segments called packets. Each packet contains the Internet address of the computer sending the data, as well as the Internet address of the computer receiving the data. Packet filters are rules that can accept or reject incoming packets based on source and destination addresses and the other identifying information. 一些防火墙是基于发送或接收请求的计算机网络地址来过滤那些从公共网络进入私有网络的数据和请求。这些防火墙被称作包过滤路由器。在因特网上，从一台计算机发送到另一台计算机的数据或请求被分割成小段，称为包。每一个包都包含有发送数据的计算机的网络地址和接收数据的计算机的网络地址。包过滤是基于收到的包的源地址和目的地址以及其他确认信息来决定是接收还是拒绝的规则。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-73 6.6.2 PERSONAL FIREWALLS Personal firewalls are designed to protect desktop systems by monitoring all the traffic that passes through the computer’s network interface card. They operate in one of two ways. With the first method, the owner can create filtering rules (much like packet filtering) that are used by the firewall to permit or delete packets. With the other method, the firewall can learn, by asking the user questions, how particular traffic ought to be handled. A number of personal firewall products are on the market, including Symantec’s Norton Personal Firewall. 6.6.2个人防火墙 个人防火墙是设计用来通过监视经过计算机网卡的所有流量来保护桌面系统。他们以两种方式工作。一种方式是，用户创建过滤规则（很像包过滤），防火墙使用这些规则来允许包通过或删除包。另一种方式是，防火墙通过询问用户问题来学习如何处理特殊的流量。市面上有很多的个人防火墙产品，包括Symantec公司的诺顿个人防火墙。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-74 6.6.3 VPNs A VPN (virtual private network) uses the public Internet to carry information but remains private by using a combination of encryption to scramble the communications, authentication to ensure that the information has not been tampered with and comes from a legitimate source, and access control to verify the identity of anyone using the network. In addition, a VPN can also be used to support site-to site communications between branch offices and corporate headquarters and the communications between mobile workers and their workplace. In all these cases, communication costs are drastically reduced. 6.6.3 VPNs 虚拟专用网使用公共的互联网来进行信息的传递，但却通过使用加密来保证通信的安全确保私密性，使用认证来确保信息没有被篡改并确保信息来源合法，用访问控制来核实网络使用者的身份。而且，VPN可以用来支持在分支机构和公司总部之间点对点通信以及移动用户和工作场所之间的通信。在这些案例中，通信成本都显著降低了。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-75 Three technologies can be used to create a VPN. First, many of the firewall packages hardware and software—support VPN functionality. Second, routers (i.e., special network components for controlling communications) cannot only function as firewalls, but they can also function as VPN servers. Finally, software solutions are available that can be used to handle VPN connections. 有三种技术可以创建VPN。首先，许多防火墙套装，包括硬件和软件，支持VPN功能。第二，路由器（即，控制通信的专门的网络组件）不仅有防火墙的功能，而且可以像VPN服务器一样运行。最后，用来处理VPN连接的软件解决方案也可以使用。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-76 6.6.4 INTRUSION DETECTION SYSTEMS Even if an organization has a well-formulated security policy and a number of security technologies in place, it is still vulnerable to attack. This is why an organization must continually watch for attempted, as well as actual, security breaches. 6.6.4 入侵检测系统 即使组织有良好规划的安全策略，应用了很多安全技术，还是容易受到攻击。这就是为什么组织必须不断地寻找潜在的和已经存在的安全缺口。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-77 In the past, audit logs, produced by a variety of system components and applications, were manually reviewed for excessive failed log-on attempts, failed file and database access attempts, and other application and system violations. Obviously, this manual procedure had its flaws. Today, a special category of software exists that can monitor activity across a network or on a host computer, watch for suspicious activity, and take automated action based on what it sees. This category of software is called intrusion detection systems (IDSs). 过去，审计日志由许多系统组件和应用程序产生，需要手动查看过度的失败登录企图、失败文件和数据库访问，以及其他应用程序和系统的反常现象。显然，这种手工方式有缺陷。现在，一种可以监视网络或主机上的活动、关注可疑活动并基于它所观察到的情况自动采取措施的特殊软件已经存在。这类软件称为入侵检测系统（IDSs）。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-78 IDSs are eigher host-based or network-based. A host-based IDS resides on the server or other host system that is being monitored. Host-based systems are particularly good at detecting whether critical or security-related files have been tampered with or whether a user has attempted to access files that they are not authorized to use. IDS可疑基于主机或网络。基于主机的IDS位于被监视的服务器或其他的主机系统上。基于主机的系统特别擅于检测是否有重要的或与安全相关的文件被篡改或是否有用户试图访问他们无权使用的文件。 6.6 Securing EC Networks Chapter 6 E-Commerce Security 电子商务专业英语 6-79 A network-based IDS uses rules to analyze suspicious activity at the perimeter of a network or at key locations in the network. It usually consists of a monitor—a software package that scans the network—and software agents that reside on various host computers and feed information back to the monitor. 基于网络的IDS在网络边缘或网络的关键位置上使用规则分析可疑的活动。它通常由监视器——扫描网络的软件包和位于不同主机上的反馈给监视器信息的软件代理组成。 6.6 Securing EC Networks Chapter 6 E-Commerce Security $$