BUSI 424 Week 4 Discussion Board Forum 4 Example

Discussion Board Forum 4: E-Commerce Security and Payment Systems

BUSI 424 E-Commerce, Discussion Board Forum 4 Thread and Replies

Thread by [Student Name]

The forum prompt, the shop and the three classmates are composites; the textbook and the research cited are real, and the structure follows Liberty's public course guide for BUSI 424.

Thread

Laudon and Traver (2017) describe six dimensions of e-commerce security: integrity, nonrepudiation, authenticity, confidentiality, privacy and availability. For a large retailer, each requires its own team. For a small online shop, I want to argue that the most important security decision is a simple one: hold as little sensitive data as possible.

Consider a candle maker selling through a small website. The owner could build checkout in-house and store customers' card numbers for repeat orders. That would make the owner responsible for protecting those numbers, for meeting the payment card industry's data security standard, and for the damage if the server were breached. Or the shop could use a hosted payment service, in which the customer's card details go directly to the processor and the shop receives only a confirmation and a token. Data the shop never holds is data a thief can never take from it. The hosted option does not remove every risk, since an attacker could still tamper with the site or steal customer addresses, but it removes the most valuable target.

Prevention is only half of security, though. When breaches happen, customers need to know so they can protect themselves. Romanosky et al. (2011) studied state laws requiring companies to notify consumers of data breaches and found that the laws reduced identity theft caused by breaches, by about 6 percent on average. The effect was modest, but it suggests that telling customers quickly helps them act, by watching statements or freezing credit, before thieves can use stolen data.

For the candle shop, then, a good security plan has three layers: a hosted payment service so card data never touches its systems, sensible protection for what it does keep, such as strong passwords and software updates, and a written plan for notifying customers promptly if anything goes wrong. Each step is cheap and sized to a one-person shop, and together they reflect the chapter's lesson on building a presence: protection belongs in the original design rather than in a repair after a breach.

There is also a business reason for this approach beyond security. Card networks and processors require merchants that store card data to meet detailed security standards and to document their compliance every year. A small shop that never handles card numbers falls into the simplest compliance category, which saves time and money that can go into the product.

Reply to Owen

Owen, your focus on encryption for the checkout page is right, and you explained clearly how a digital certificate lets the browser confirm it is talking to the real store. I would add one internal control that many small shops overlook: protecting the accounts of the people who run the store. If an attacker guesses or steals the owner's password to the store's administrative panel, encryption on the checkout page does not help, because the attacker can change prices, redirect payouts or copy customer lists from the inside. Requiring two-factor authentication for every staff login, so that a password alone is not enough, closes much of that gap. It also helps to give each employee a separate account with only the permissions their job requires, so a single compromised login cannot reach everything. These steps address the authenticity and integrity dimensions from the textbook, and they cost almost nothing on most hosted platforms. Regular review of who has access matters too, since former employees and contractors often keep logins long after they leave. Removing those accounts the day someone departs is one of the cheapest protections a small store can adopt. Does the platform you used in your example support two-factor login?

Reply to Grace

Grace, I appreciated your honest point that small businesses have limited budgets for security, and your list of affordable tools was useful. I want to gently question one statement, though, that small shops are unlikely targets because hackers go after big companies. Many attacks are automated: programs scan thousands of websites looking for outdated software or weak passwords, and they do not care how large the business is. A small shop with an unpatched plug-in may actually be easier to break into than a large retailer with a security team. Small businesses can also be used as a stepping stone, for example to send fraudulent emails to their customers. The good news is that the same affordable steps you listed, updates, strong passwords and a hosted payment service, protect against most of these automated attacks. I would just frame them as necessary rather than optional. Backups deserve a place on the list as well. Ransomware attacks lock a business out of its own files, and a shop with recent backups stored separately can restore its site in hours instead of paying a ransom or losing weeks of orders. Backups cost little on most hosted platforms. Have you seen a small business that dealt with an attack?

Reply to Isaac

Isaac, your thread on mobile wallets made a strong case that they are more convenient for customers. I would extend your point by explaining why they are often more secure as well, which makes them a good fit for the payment chapter. Mobile wallets use tokenization: instead of passing the actual card number to the merchant, the phone sends a unique token that works only for that device and, often, only for that transaction. If a merchant's system is breached, the stolen tokens are useless elsewhere. Wallets also require the customer to authenticate with a fingerprint, a face scan or a passcode, which adds a layer the card itself lacks. For a small online shop, accepting mobile wallets therefore improves both conversion and security at once. One limitation is that not every customer uses a wallet, so shops still need a secure way to accept regular cards. Wallets also reduce fraud disputes for merchants, because a payment authenticated on the customer's own device is harder for a thief to make with a stolen card number. Fewer chargebacks mean lower fees and less time spent contesting claims. That benefit alone can justify adding wallets at checkout. Did your example business see more mobile wallet use from younger customers?

References

Laudon, K. C., & Traver, C. G. (2017). E-commerce 2016: Business, technology, society (12th ed.). Pearson.

Romanosky, S., Telang, R., & Acquisti, A. (2011). Do data breach disclosure laws reduce identity theft? Journal of Policy Analysis and Management, 30(2), 256-286. https://doi.org/10.1002/pam.20567