Front-End and Back-End Threats to Online Businesses

Overview of Online Businesses

There are now thousands of businesses involved in e-commerce. Some of these businesses also maintain traditional stores, while others — such as eBay and Amazon — operate solely on the internet. According to an article in the Journal of International Business Studies, even though the dotcom bust meant the end of many online businesses, it did not mean that e-commerce could not or would not become a lucrative form of commerce.

Indeed, companies such as eBay and Amazon have proven that the internet can be a very profitable environment. Many entrepreneurs choose to conduct business online because of the inherent benefits the internet offers. As Kundu and Singh (2002) explain, e-commerce corporations (ECCs) are unique in four ways:

"First, from their inception, ECCs have multinational accessibility. Second, ECCs compete not just with domestic firms but also with firms all over the world. Third, these new breed of Internet-based multinationals are largely small or medium-sized firms that strategically use complementary assets through networks of partnerships and alliances. Finally, unlike traditional multinationals, ECCs on the Internet have a unique set of advantages based on network resources, open accessibility, innovative entrepreneurship, and information sharing."

The internet offers businesses a unique set of opportunities to reach customers in an unprecedented manner. Although these opportunities create a platform upon which businesses can become extremely successful, they have also created a wide range of threats. The following sections focus on specific threats related to the front-end and back-end systems of online businesses.

Front-End and Back-End System Threats

Every online business must deal with threats related to how it operates. One of the primary threats that internet businesses face concerns front-end and back-end systems. Front-end systems refer to a workstation or group of workstations that supply operators with the ability to network with a large-scale computer system. The back-end system refers to business and legacy systems that support inventory, order processing, and receivables for both buyers and suppliers in business-to-business e-commerce.

According to Mike Harris's article "What is E-Commerce," the threats to front-end systems include the following:

Web server or internet connection overload due to unforeseen demand for access, causing a loss in performance or problems with the system. This threat can lead to a loss of revenue because consumers may choose to do business with another online company instead.

Websites displaying the wrong price or product information. This is a threat because profits can be eroded if products are sold at an incorrect price.

Disclosure of private information held within a website, including personal data such as phone numbers, addresses, and credit card numbers. This threat typically arises when security features are not installed properly. It is perhaps the single most prevalent threat to online businesses, because identity theft is a serious problem that can ruin the credit of the victim. As Sovern (2004) notes, identity theft is "the practice of using the identity of another to obtain credit. After the identity thief defaults, lenders and credit bureaus attribute the default to the impersonated consumer."

Web pages altered to display obscene or pornographic materials. This can occur when a system is vulnerable and infiltrated by hackers, who may have the capacity to alter the contents of a web page. When this occurs, online businesses can lose customers who are offended by the content and never return to the site.

Failure of the web server due to unreliable software or hardware, or because of operational mistakes. Such failures can damage an online business's reputation, as these problems tend to attract significant attention in media outlets.

All of these threats are present for online businesses with respect to front-end systems. Many tactics can be employed to minimize them, but in most cases they cannot be completely eliminated.

In addition to front-end threats, online businesses must also contend with back-end threats. According to Harris, these include:

Failure to connect front-end and back-end systems, which can cause incorrect or outdated information to be displayed on websites. This means that commitments made to customers cannot be fulfilled.

An unexpected number of transactions from e-commerce web servers degrading the performance of essential internal systems, disrupting critical business functions and the systems that depend on them.

Internal systems vulnerable to unauthorized access through the internet, which can allow hackers to corrupt critical information and cause serious business disruption.

Front-end applications subverted to pass incorrect information to back-end systems, causing those systems to function in undesirable ways. This threat has the potential to cause important business systems to fail because they cannot handle an onslaught of unexpected data.

Vulnerability Analysis and Assessment Tools

To analyze how vulnerable a company is to certain threats, companies perform vulnerability analysis and rely on various assessment tools. Online businesses must use risk management to identify what threats are present and how to reduce them. Vulnerability analysis can be used to measure the risks associated with many different types of threats that an organization may face.

According to Amanda Andress in Surviving Security: How to Integrate People, Process, and Technology, such an analysis can be utilized to check an organization's systems for vulnerabilities and to assess the likelihood that a vulnerability will be successfully exploited. The analysis should not only include electronic risks but also physical risks, such as an individual using a removable storage device to steal or modify data. As Andress explains, citing Charles LeGrand, "a vulnerability is the absence of or ineffective implementation of safeguards or controls. For example, the failure to adequately safeguard a known hole in a Web server might allow an attacker or business competitor to shut down your organization's Web server, your main means of revenue."

Andress further asserts that in addition to analyzing host-level and network-level threats, online businesses should examine the applications running on their systems, including both web and email servers. Most successful attacks typically result from misconfigured or unpatched web servers. Addressing this aspect of analysis ensures that an organization covers the primary points of attack for its networks and systems.

When vulnerability assessment tools were first made available, scanning was the primary method used. Today, however, tools such as intrusion-detection software (IDS) are also available. IDS differs from scanning software in that it works by looking for patterns of illegitimate network traffic consistent with a breach of the system. Scanners, by contrast, identify whether a computer's actual configuration is vulnerable to attack. In other words, IDS is reactive, whereas scanning software is proactive.

As Cameron Sturdevant notes in "Three Vulnerability Assessment Tools Put to the Test," vulnerability assessment systems "scan operating systems and applications for potential problems, such as the use of default passwords or configurations and open ports. This can give administrators a head start in fixing problems and will, hopefully, let IT organizations more effectively beat bad guys to the punch." This benefit holds, however, only when vulnerability systems successfully identify all problems present in an application.

Research has often demonstrated a gap between the best vulnerability assessment tools and the actual weaknesses in a test network. Nevertheless, IT employees responsible for securing assets will find vulnerability assessment tools beneficial even if all they accomplish is eliminating some of the routine, monotonous work involved in security maintenance.

Conclusion

This discussion examined the front-end and back-end threats associated with the online business industry and compared the strategies of eBay and Amazon in managing those threats. The research found that front-end and back-end vulnerabilities expose both businesses and their customers to significant risk. It also found that vulnerability analysis techniques and assessment tools assist companies in eliminating or reducing these vulnerabilities, even if the threats themselves can never be entirely removed. As e-commerce continues to grow, the importance of robust security practices will only increase for businesses operating in the digital marketplace.