XP – Extreme Programming

Extreme Programming - XP is an agile technique of software development dedicated on providing the high customer value in the fastest possible way.

The traditional software development procedure is linear, with each stage of the development lifecycle requiring conclusion of the previous or the earlier stage. For instance, designing of the software starts only on completion of the entire program analysis, and coding starts only after end of the design. This concept of development works fine when customer requirements remain static throughout, but in practice, requirements change often and cause numerous editing of programs leading to mistakes and software ‘rot.’

Extreme Programming - XP shots the traditional software development procedure sideways. Rather than planning, analyzing, and designing in a linear manner, XP programmers carry out actions at a time throughout the software development Phase. The method stands resemblance to a puzzle with the development of many small iterations that make no sense independently, but making for a comprehensive package when combined. The biggest benefit of this methodology is the resilience it provides, permitting for easy integration of changes.

The Extreme Programming software development practice begins with planning, and all iterations consist of four basic stages in its lifecycle: Designing, Coding, Testing, and Listening.

The prevailing values that drives the Extreme Programming life cycle are frequent communication with the customer and among the team members, simplicity by simple understandable solution, everyday feedback through unit and acceptance testing, and the audacity to take on complications proactively and integrate testing and changes in the software development phase.

Planning

The first stage of Extreme Programming life cycle is Planning, where customers, clients or users meet with the software development team to build ‘user stories’ or requirements. The development team translates user stories into iterations that cover a minor part of the functionality or features required. A combination of iterations delivers the customer with the final completely functional product.

Programming team formulates the Plan, Time, and Costs to carry out the iterations, and individual software developer’s sign up for iterations.

One of the Planning method is the critical path method, grouping iterations essential for project progress in a lined fashion, and arranging for accomplishment of other iterations parallel to the critical path.

Designing

An iteration of Extreme Programming starts with Designing. The controlling principles of this phase are:

Emphasis on simplicity and not adding functionality in anticipation. Using systems symbol or standards on names, class names and methods, and approving on uniform styles and formats to safeguard compatibility amongst the different team member’s work.

Using Software Class Responsibilities and Collaboration Cards that permit for a parting from the traditional procedural approach and make probable object oriented technology. Such cards let all members of the project team to add ideas, and assemble the best ideas into the software design.

Building spike solutions or modest programs that explore probable solutions for a specific problem, discounting all other concerns, to mitigate risk.

Coding

Coding constitutes the most important phase in the Extreme Programming life cycle. XP programming gives priority to the actual coding over all other tasks such as documentation to ensure that the customer receives something substantial in value at the end of the day.

Standards linked to coding include:

Developing the code built on the agreed metaphors and standards, and adopting a policy of shared code ownership. Pair programming or mounting code by two programmers working together on a single device, aimed at creating higher quality code at the same or less cost.

Regular integration of the code to the dedicated repository, with only one pair assimilating at a time to prevent conflicts, and optimization at the end.

Testing

Extreme program incorporates testing with the development phase rather than at the end of the software development phase. All codes have unit tests to remove bugs, and the code passes all such unit tests before release.
Additional key test is customer acceptance tests, based on the customer conditions. Acceptance test run at the achievement of the coding, and the developers provide the customer with the consequences of the acceptance tests along with demonstrations.

Listening

The basis of extreme programming XP is a continuous scheme of customer involvement through continuous feedback during the development phase. Apart from the clients, the developer also obtains feedback from the project manager.

The basis of continuous feedback is the client acceptance tests. Each and every feedback of the client that specifies reviewed requirement becomes the base of a new design, and the lifecycle repeats itself. If the client remains satisfied with the test consequences the iteration ends there, and the design for the new iteration starts, which again trails the design-coding-testing-listening cycle.

References :

• http://www.brighthubpm.com/methods-strategies/88996-the-extreme-programming-life-cycle/

Reasons behind Merger and Acquisition

Introduction

Mergers and Acquisitions have always kept the attention of economists alive. Mergers and Acquisitions may well prove to be favorable depending on the strategies and approaches adopted, but it would not be factual to say that all mergers and acquisitions have been successful.

Motivations for Mergers and Acquisitions

Companies go for mergers and acquisitions for many reasons. Some of these reasons are good, in that the motivation for carrying out the merger and acquisition is to maximize the shareholder’s value. Unfortunately, other motives are bad, or at least questionable.

Theoretically, software development companies should pursue an acquisition only if it creates value—that is, if the significance of the acquirer and the target is superior if they operate as a single body rather than as separate ones.

If the expertise of both are amalgamated, it produces synergy.  A merger or acquisition is justified if synergies are linked with the transaction. Synergies can take three forms: operating, financial, or managerial. By applying the rules of synergy effectively, a merger can be made a success.

There are several reasons why companies pursue merger and acquisition. Few of them as explained as follows:  

Increasing capabilities

Increased capabilities might arise from expanded research and development opportunities or more robust IT services and operations. Similarly, many software development companies may want to combine to leverage costly IT services and operations.

Capability might not be a particular area or segment; the capability might come from acquiring a unique and innovative technology platform rather than willing to build it.  Mostly Biopharmaceutical companies are a hothouse for M&A due to the high investment necessary for successful Research & Development in the market.

Gaining a competitive advantage or larger market share

Many firms or companies decide to merge in order to gain a better distribution or to build enlarge the network. A company might want to expand into different market segments or the markets where alike company is already operating rather than starting from the scratch, and so the company decide to merge with the other company.

This business network gives both companies a broader customer base overnight.

Synergy

The commonly used word in Merger and Acquisition is synergy, which is the idea that by combining business activities, performance will increase and costs will decrease. Essentially, a business will attempt to merge with another business that has complementary strengths and weaknesses.

Diversifying products or services

Another reason for merging and acquiring companies is to complement an existing product or service. A company that merges to diversify may acquire some other company in order to reduce the influence of a specific business's performance on its profitability. Two companies may be able to combine their products or services to gain a competitive edge over others in the market. Companies willing to sharpen focus often merge with other companies with deeper market penetration.

Cutting cost

When two companies have similar kind of products or services, merging them can create larger opportunity to reduce or cut down cost. When companies merge, often they have an opportunity to reduce operating costs by integrating and restructuring support functions.

When the total production cost of services or products is lowered as there is increase in the volume, the company thus maximizes total profits.

Growth

Mergers and Acquisitions can give the acquiring company a chance to raise market share without having to do work by themselves - instead, they can purchase a competitor's business for a value or a price. Usually, these are known as horizontal mergers.

Eliminate Competition

Many Merger and Acquisitions permits the acquirer to eliminate upcoming competition and gain a larger market share. The problem with this is that a large premium or effort is usually needed to convince the aimed company's shareholders to agree to take the offer.

References :

http://www.investopedia.com/ask/answers/06/mareasons.asp

http://www.cio.com/article/2892329/mergers-acquisitions/reasons-mergers-and-acquisitions-happen.html

Counter Measures of Popular Network Attacks

For the first few decades of their presence, computer networks were mainly used by university researchers for distribution of e-mail and by corporate employees for allotment of printers and other properties in all organizations including software companies in India. Under these situations, security did not get a lot of consideration. But now, as millions of people are using networks for their everyday use such as banking, shopping, and filing their tax returns, network security is approaching on the horizon as a potentially huge problem. Because all their regular activities are data sensitive means data should not be changed.

ATTACKS AND THEIR COUNTERMEASURES:

A. Mac flooding: 

MAC flooding is a technique employed to conciliation the security of network switches. Switches maintain a MAC Table that maps distinct MAC addresses on the network to the physical ports on the switch. 

Counter measures: To stop MAC flooding one of the subsequent features should be construct in switch for asp.net software companies India. 

Port security: Post security should be arranged which bounds number of MAC addresses that can be learned on ports linked to end stations. 

Implementations of IEEE 802.1X suites: It often permit packet filtering rules to be installed explicitly by an AAA server built on dynamically learned info about clients with the MAC address.

B. Session hijacking:

session hijacking, also known as cookie hijacking is the use of a valid computer session sometimes also called a session key to get unauthorized access to information or services in a computer system.  

Counter measures: There are numerous types of countermeasures which are listed underneath: 

Encryption: Banks and e-commerce services should use this method because it stops sniffing style attacks for c#.net software companies in india. Some user services make extra checks against uniqueness of the user. 

String as Session key: This stops attacker to guess valid session key over Brute Force attack. 

Reinforcing of Session ID after a Successful Login: This method stops session addiction, because attacker does not recognize the Session ID of the user after she has logged in. 

C. IP Spoofing  

IP spoofing, also known as IP address forgery or a host file hijack, is a hijacking method in which a cracker masquerades as a reliable host to conceal his identity, spoof a Web site, hijack browsers, or get access to a network. 

Counter measures: The countermeasures are given as under  

Encryption and Authentication: This technique is implemented in IP V6 that eliminates current spoofing threats for c#.net software companies India. There should be proper authentication process in place. 

Router filtering: Spoofing can be stop at router level by implementing ingress and egress filtering. Access Control List should be maintaining to allow only trusted IP to interact with your network.

D. Denial of Service Attack  

Denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its planned users, such as to temporarily or indefinitely interrupt or suspend services of a host associated to the Internet.

Counter measures: The DOS [3] attack has subsequent counter measures, 

Smurf Attack: This form of an attack includes sending Internet Control Message Protocol (ICMP) or ping requirements to numerous Internet Protocol (IP) broadcast addresses. All of these messages have a spoofed source address of the envisioned victim. The hosts getting the ICMP echo request with accepting it reply with an echo to the source address, which in this case is the objective of the attack. The weight of this attack is thus effectively increased by the number of replying hosts. If the attack took place on a multi-broadcast network there could possibly be hundreds of machineries to reply to every packet sent. 

UDP Flood: A UDP flood, also known as a fragile, is a partner to the Smurf attack. This is founded on UDP echo and character generator. It practices a forged UDP packet to join the echo service on one machine to the chargen on alternative. These two machineries then practices all accessible bandwidth, sending characters back and forth among themselves. 

SYN Flood: A SYN flood uses the TCP standard 3-way handshake protocol. The attacker starts a connect request to the server and then overlooks the acknowledgement (ACK). This forces the server to delay for the ACK from the attacker, worsening time and resources of asp dot net software companies in India. A server can process a fixed number of requests at any given time and so this form of attack can efficiently block all legitimate traffic. 

With the overview of computer network attacks and their particular countermeasures can help us in safeguarding our data and system from hackers.

Impact of wearables on BYOD

It’s a known fact that many IT departments struggled with the growth in BYOD policies adopted by software development companies all over the globe. In an effort of protecting critical business data and making sure that all devices worked properly as employees used their own devices for work, IT had to handle more complex challenges. But that complex problem has now moved on to the next level, as employees have started bringing wearable devices for work.

With the latest announcement of the Apple Watch, alongside other wearable gadgets like Samsung’s Galaxy Gear and Google Glass, the wearable device market is on the verge of exploding. (Burrus, 2014) estimated sale of 10 lakhs wearable devices in 2014, and the same number is predicted to increase to 3000 lakhs by 2018. IT workers need to get prepared now, because wearable devices are making their place in the office premises sooner rather than later.

Wearable devices have the benefit of creating unique opportunities for a software development company though these devices also bring along the threats in a globally connected world.

Assimilating wearable devices into the work environment can arise a situation where company information is even more suitably accessed and utilized. For example, software installation can be done using smart glasses by following step by step instructions in case the installation procedure is complex.

The advantages might tempt business leaders to use wearable devices, but the same technology also brings with it, some drawbacks, the most concerning being increased security risks. IT workers have spent lot of their efforts in testing and approving apps using MDM software. As wearable devices become more prevalent, new apps will be developed, forcing IT department to go through that whole process once again.

IT departments will also have to build security controls for these new devices. Most organizations have controls in place that include a remote lock or wipe feature, where devices that are misplaced or stolen can be locked or wiped to ensure the data which resides inside the device is protected from unauthorized visitors. These controls will have to be created for wearable technology too.

There are also concerns over how wearable devices might be used to steal information by employees within the company (like an employee secretly recording a confidential meeting using smart glasses). So as this new technology comes alive, the search to answer these questions begins.

Even if the security concern is properly addressed, other significant obstacles will keep the businesses away from using wearable devices widely in the immediate future. Currently, most of these devices are expensive with prices out of the range of the average customer. Strategic level employees such as CXOs may use them, but making them available for operational level employees will be difficult until prices decline.

The other concern is the cost of data that comes with using more mobile devices in the work environment. As more innovative gadgets make their way to the workplace, increasing the amount of consumption of data, which can reduce the bandwidth of a business’s network. Pair that with the security risks mentioned above, and prevalent adoption of wearable devices under a BYOD policy might take a year or more to happen.

It took years for software development companies to finally get a handle on BYOD when it came to mobile devices and tablets. That epoch of BYOD created a radical shift in the business world which increased efficiency but introduced new security risks.

Conclusion: 

Wearable devices will likely outgrowth the next revolution in the workplace. If businesses don’t want to be caught unprepared, now is the time to create the policies and procedures to deal with the influx of new technology. With the right strategies in place, every software development company adapting WYOD will be able to gain maximally from the benefits while minimizing the drawbacks.

Bibliography

Burrus, D. (2014). How Wearables will Transform Business. Burrus Research.

Data Mining

Introduction:

      Data mining, the extraction of hidden predictive information from large databases, is a powerful new technology with great potential to help companies focus on the most important information in their data warehouses. Data mining tools predict future trends and behaviors, allowing businesses to make proactive, knowledge-driven decisions. The automated, prospective analyses offered by data mining move beyond the analyses of past events provided by retrospective tools typical of decision support systems. Data mining tools can answer business questions that traditionally were too much time consuming to resolve. They drill down databases for hidden patterns, finding predictive information that experts may miss because it lies outside their expectations. Data mining also helps for content management systems that manage the process of gathering data, transforming it into useful, actionable information, and delivering it to business users.

Benefits:

Marketing / Retail:

• Data mining helps marketing companies build models based on historical data to predict who will respond to the new marketing campaigns such as direct mail, online marketing campaign etc. 
• Through the results, marketers will have an appropriate approach to selling profitable products to targeted customers.

Finance / Banking:

• Data mining gives financial institutions information about loan information and credit reporting. 
• By building a model from historical customer’s data, the bank, and financial institution can determine good and bad loans. 
• In addition, data mining helps banks detect fraudulent credit card transactions to protect credit card’s owner.

Manufacturing:

• By applying data mining in operational engineering data, manufacturers can detect faulty equipment and determine optimal control parameters.
• Data mining has been applying to determine the ranges of control parameters that lead to the production of the golden wafer. 
• Then those optimal control parameters are used to manufacture wafers with desired quality.

Government:

• Data mining helps government agency by digging and analyzing records of the financial transaction to build patterns that can detect money laundering or criminal activities.

Challenges:

There are so many challenges faced by software development companies regarding data mining as follow:

Privacy Issues:

• The concerns about the personal privacy have been increasing enormously recently especially when the internet is booming with social networks, e-commerce, forums, blogs etc.
• Because of privacy issues, people are afraid of their personal information is collected and used in an unethical way that potentially causing them a lot of troubles. 
• Businesses collect information about their customers in many ways for understanding their purchasing behaviors trends. 
• However, businesses don’t last forever, some days they may be acquired by other or gone.
• At this time, the personal information they own probably is sold to other or leak.

Security Issues:

• Security is a big issue. Businesses own information about their employees and customers including social security number, birthday, payroll and etc. 
• However how properly this information is taken care is still in questions. 
• There have been a lot of cases that hackers accessed and stole big data of customers from the big corporation such as Ford Motor Credit Company, Sony etc. with so much personal and financial information available, the credit card stolen and identity theft become a big problem.

Misuse of information:

• Information is collected through data mining intended for the ethical purposes can be misused.
• This information may be exploited by unethical people or businesses to take benefits of vulnerable people or discriminate against a group of people.

Conclusion:

Data mining is an important part of knowledge discovery process that we can analyze an enormous set of data and get hidden and useful knowledge.  This concept is very useful to all software development companies in India.

Analysis in Risk Assessment

Most important step in measuring level of risk is to determine the adverse impact subsequent from a successful threat exercise of a vulnerability. Before initiating the impact analysis, it is compulsory to obtain the following necessary information.

• System mission (e.g., the procedures performed by the IT system)
• System and data criticality (e.g., the system’s value or significance to an organization)
• System and data sensitivity.

This information can be attained from existing organizational documentation, for example the mission impact analysis report or asset criticality assessment report. A mission impact analysis(also recognized as business impact analysis [BIA] for some software companies in India) prioritizes the impactlevels related with the compromise of an organization’s information assets based on aqualitative or quantitative valuation of the sensitivity and criticality of those assets. An assetcriticality assessment recognizes and prioritizes the sensitive and crucial organization information assets (e.g., hardware, software, systems, services, and related technology assets) that pillar the organization’s critical missions.

Few tangible impacts can be measured quantitatively in lost revenue, the price of repairing thesystem, or the level of effort needed to correct problems caused by a fruitful threat action.Additional impacts (e.g., loss of public confidence, loss of credibility, damage to an organization’sinterest) cannot be calculated in specific units but can be qualified or labelled in terms of high,medium, and low impacts. Because of the generic nature of this discussion, this guide entitlesand describes only the qualitative classifications—high, medium, and low impact

Magnitude of Impact : Impact Definition

High Exercise of the vulnerability

1. may result in the exceedingly costly loss ofmajor tangible assets or resources; 
2. may significantly disturb, harm, orimpede an organization’s mission, reputation, or interest;
3. may resultin human death or severe injury.

Medium Exercise of the vulnerability 

1. may result in the pricy loss of tangibleassets or resources; 
2. may violate, harm, or obstruct an organization’smission, reputation, or interest; or 
3. may result in human harm.

Low Exercise of the vulnerability 

1. may result in the loss of some tangible assets or resources or 
2. may strikingly affect an organization’s mission, reputation, or interest.

Quantitative versus Qualitative Assessment

In steering the impact analysis, consideration should be given to the benefits and shortcomings of quantitative versus qualitative assessments. The foremost advantage of the qualitative impact analysis is that it priorities the risks and classifies areas for instant improvement in addressing the vulnerabilities. The shortcoming of the qualitative analysis is that it does not deliver specific quantifiable measurements of the magnitude of the impacts,consequently making a cost-benefit analysis of any commended controls difficult.The major advantage of a quantitative impact analysis is that it delivers a dimension of the impacts’ magnitude, which can be used in the cost-benefit analysis of recommended controls.The shortcoming is that, depending on the numerical ranges used to express the measurement,the connotation of the quantitative impact analysis may be unclear, wanting the result to be interpreted in a qualitative manner. Supplementary factors often must be considered to determine the magnitude of impact. These may include, but are not limited to—

• An approximation of the occurrence of the threat-source’s exercise of the vulnerability over a quantified time period (e.g., 1 year)
• An approximate cost for each incidence of the threat-source’s exercise of the vulnerability
• A numerical factor based on a subjective analysis of the comparative impact of a specificthreat’s exercising a specific vulnerability.

Business impact analysis (BIA) is a methodical process to determine and evaluate the prospective effects of an interruption to critical business operations as a result of a catastrophe, accident or emergency. A BIA is an indispensable component of business continuance plan of almost any software company in India; it comprises an exploratory component to disclose any vulnerabilities and a planning component to cultivate strategies for minimising risk.

Password Hacking Techniques

There are number of methods used by hackers to hack your account or get your personal information like password. Password hacking is very common nowadays. So Web development companies should implement countermeasures of password hacking. The most common password hacking tricks and their countermeasures are as follow:

Brute force attack: 

• Brute-force attack is used to crack any password. 
• Brute-force attacks try every possible combination of digits, alphabets and special characters until the correct password is match.
• Brute-force attacks can take very long time depending upon the complexity of the password. 
• Countermeasures:
•  Use long and complex passwords.
•  Try to use combination of upper and lowercase letters along with numbers.

Social Engineering:

• It is process of manipulating someone to trust you and get information from him/her. 
• Let’s take an example. If the hacker was trying to get the password of his co-workers’ computer, he might call them pretending to be from the IT department and simply ask for their login details. 
• It can be used to hack password, bank credentials or any personal information.
• Countermeasures:
• Never ever give your credit card details on phone.
• If someone tries to get your personal or bank details ask them few questions.

Rats and Key loggers:

• Key logger is sent to the victim’s computer to crack a password.
• Now hacker keeps monitoring everything victim does on his computer including password by key loggers.
• So it is major concern for software development companies.
• Countermeasures:
• Never login to your personal user account from someone else or cyber cafe computer.
• Use latest anti-virus software and keep them updated.

Phishing:

• This attack is used by hackers to get someone account details like username and password.
• In this attack, hacker sends fake page of real website like Facebook, Gmail to victim. When someone login through that fake page, his details is sent to the hacker. 
• Countermeasures:
• Always make sure that websites URL is correct.
• For example, you should check whether it is gmail.com or phishing page gmmail.com.

Rainbow Table:

• Rainbow table is a big pre-computed list of hashes for every possible combination of characters.
• A password hash is a list of passwords that have gone through a mathematical algorithm and are transformed into something which is not recognizable. 
• A hash is a nothing but an encryption so when a password is hashed it cannot get back to the original string from the hashed string.
• Countermeasures:
• Make sure the password chosen is long and complex. 
• Creating tables for long and complex password takes a very long time and a lot of resources.

Guessing:

• This can easily help attacker to get someone’s password within seconds.
• If hacker knows you, he can use your personal information he knows about you to guess your password. 
• Countermeasures:
• Don't use your first name, nickname, mobile number or birthdate as your password. 
• Create complex and long password with combination of letters and numbers.

Dictionary Attack:

• A file of words is run against user accounts, and if the password is a simple word, it can be found pretty quickly.
• Countermeasures:
• Use long and complex passwords. 
• Try to use combination of upper and lowercase letters along with numbers.

Conclusion:

This article is for everyone including web development companies in India to protect their personal information like username, password. Countermeasures suggested above should be implemented.

Frauds in Online Payment Systems

Nowadays, everything is online. Online shopping, online money transfers and online banking help in saving a lot of time and making our lives easier. These facilities are provided by software development companies in  India by developing online payment system software. However, these same technologies also make life easier for cyber criminals by offering them short and quick ways to steal users’ money. 

Using stolen payment data is an effective and popular way of making a quick profit. Hacking a bank is more time-consuming and expensive and the risk of being caught is higher. By contrast, many individuals use computers with different vulnerabilities, which can be compromised easily. By stealing a comparatively lesser amount from each hacked online banking account, a cyber criminal has a good chance of going undetected. 

Frauds are classified as follows:

• Online frauds
• Offline frauds

Online frauds occur when fraudster owns legitimate company to get sensitive personal information and illegally conduct transactions in the existing accounts. Phishing and spoofing are types of online frauds. Online frauds occur when fraudster steals sensitive information of customers such as bank account number, credit card number or other identification and uses it to open new account or performs transaction in the customer/company's name. There are many types of e-frauds in online payment systems and they can occur in following ways:

Account Hacking:

1. Hacking includes gaining illegal entry into a person computer system during online payment. Fraudster use compromised customer credentials to hack the origination system and misuse it in the legal account holder's name.

Identity Theft:

1. Identity theft refers to crime in which fraudster illegally gets and uses another individual's personal information in such a way that involves fraud to gain something of value during online transaction.

Phishing:

1. Phishing is a well-known technique for obtaining confidential sensitive personal information from any customer by posing as a trusted authoring. It is an attack by fraudster to "fish‟ for your baking details through emails having attachment files or hyperlinks to different websites. This e-mail creates a fake image to be sent from legitimate organization to cheat people in order to disclose sensitive information.
2. On clicking any attachment or the hyperlink residing in e-mail ,the computer system get infected with malware. Now when next online transaction takes place, the malware will activate and steal private and personal financial information which includes credit card numbers, PIN number which is used by fraudster to steal money from the account.

Spoofing:

1. This attack is about creating a fake or duplicate website for criminal use. The fraudsters  are having fake companies name, logos, graphics and even code. This often takes form of  trade sites where in people would innocently providing personal information to criminals or purchase of a fake product that actually does not exist.

Check frauds:

1. Check frauds are a major threat to financial security. Electronic check frauds can be easily taken place; the fraudster uses printer, desktop phishing software and scanner. The most common forms of check fraud include altering check, forging endorsement, counterfeiting checks and creating remote checks.

Nigerian advance free fraud:

1. This e-fraud is the most popular and lucrative fraud. Fraudsters often arrive with bulk mailing or family member email of asking the recipients to enter into business and getting money transferred with huge commission in return. 
2. Once the contact is established the fraudsters request money in advance which need opening of an account in the bank or paying some fee which leads to troubles and expenses.

Lottery frauds:

1. One will receive scam emails informing of winning a substantial amount of money in a lottery draw. When the receiver reply's, the sender then asks for bank account details and other personal information so they can transfer the money. These emails are fake and may ask to pay a handling fee that will lead to loss of money and your personal information which may be used in other fraud.

Conclusion:

E-frauds are taking place in online payment systems. So it is becoming a danger for software development companies in India as online payment systems are developed by these companies. There should be encryption algorithms implemented to reduce these e-frauds.

Security Issues in E-commerce

E-commerce is nothing but buying and selling products or services over electronic systems such as Internet. Nowadays, wide variety of commerce is conducted via e-Commerce. E-commerce systems are based upon internet use developed by ecommerce solution providers in India and across globe, which provides open and easy communications on a global basis. Consumers browse through catalogues, searching for best offers, order goods and pay them electronically.

Doing some electronic business on the Internet is already an easy task. As is cheating and snooping. The use of the internet means that your internal IT and e-commerce systems are potentially accessible by anyone, irrespective of their location. So threats to e-Commerce systems are increasing day by day.

Some of the more common threats  to e-commerce systems include:

• Carrying out denial-of-service (DoS) attacks that stop access to authorised users of a website, so that the site reduces level of its service.
• Gaining access to sensitive data such as price listing, service catalogues and valuable intellectual property and altering, destroying or copying it
• Altering your website and so harming your reputation or directing your customers to another site
• Gaining access to financial information about your business or your customers, with a view to committing a fraud
• Using viruses to corrupt your business data

Security of E-commerce is protecting e-commerce assets from unauthorized access, use, alteration, or destruction. Some major security features are as follows:

• Authentication:
  Verifies who you say you are.
  It enforces that you are the only one who can login to your Internet banking account.
• Authorization:
  Allows only you to manipulate your resources.
  This can help you prevent increasing the balance of your account or deleting a bill.
• Encryption:
  Deals with information hiding.
  It ensures cardholder data is hidden during Internet banking transactions.
• Auditing:
  Keeps a record of operations. 
  Sellers use auditing to confirm that you bought specific merchandise.
• Integrity:
  Prevention against unauthorized data alteration.
• Non-repudiation:
  Prevention against any one party from disagreeing on an agreement after the fact.
• Availability:
  Prevention against data delays or removal.

There are majorly three types of security threats for e-Commerce:

1. Denial of service
2. Unauthorized access
3. Theft and fraud

Denial of service attack:

Two primary types of DOS attacks: spamming and viruses

Spamming:

• Sending unsolicited emails to everyone.
• A hacker responsible for E-mail bombing targeting one computer or network, and sending many number of email messages to it.
• Surfing involves hackers placing software agents onto a third-party system and setting it off to send requests to a specific target.
• DDOS (distributed denial of service attacks) involves hackers placing software agents onto a number of third-party systems and setting them off to simultaneously send requests to an intended target.

Viruses:

• Compromised computer programs designed to perform unwanted events.

Unauthorized access:

• Illegal access to systems, applications or data
• Listening to communications channel for finding secrets.

Theft and fraud:

• Cardholder data theft during online shopping using e-Commerce.
• Fraud occurs when the stolen data is modified or misused.
• Steal software via illegal copying from company‘s servers.
• Steal hardware, specifically laptops.

Conclusion:

There are so many security issues going on in e-Commerce. This is very major concern for ecommerce solution providers in India and across globe. So there should be some security mechanisms to overcome these security issues.

References

Books

[1] E-Commerce Payment Solutions Implementation and Integration Using IBM Websphere Payment Manager, IBM Redbooks, Vervante

[2] http://www.mastercard.com/us/company/en/newsroom/McWilton_Future_of_Electronic_Payments_whitepaper.pdf

[3] http://thismatter.com/money/banking/payment-systems.htm

[4] http://www.wired.com/2010/02/ff_futureofmoney

[5] https://en.wikipedia.org/wiki/Apple_Pay

[6] http://zeendo.com/info/googles-mobile-payment-system-past-present-and-future

[7] http://sixrevisions.com/tools/online-payment-systemsBooks

URL

[1] E-Commerce Payment Solutions Implementation and Integration Using IBM Websphere Payment Manager, IBM Redbooks, Vervante

[2]http://www.mastercard.com/us/company/en/newsroom/McWilton_Future_of_Electronic_Payments_whitepaper.pdf

[3] http://thismatter.com/money/banking/payment-systems.htm

[4] http://www.wired.com/2010/02/ff_futureofmoney

[5]https://en.wikipedia.org/wiki/Apple_Pay

[6] http://zeendo.com/info/googles-mobile-payment-system-past-present-and-future

[7] http://sixrevisions.com/tools/online-payment-systems

[8]http://www.ifourtechnolab.com/

Emerging payment challenges

As the Business-to-Consumer (B2C) commerce model progresses, further complex requirements will be made on the payments software of the future. The following sections,suggested by software development companies, outline real-life payments scenarios that will require electronic payments solutions in any payment system of the future.

Manufacturers’ coupons

When customers purchase products from Internet or ecommerce development company , at that time they can use manufacture coupons to discount the amount. The coupons often have expiration date.

For supporting these feature the payment system require to be have knowledge of the item details of shopping cart so that the coupon can be authorized and redeemed for payment.

Deferred credit 

Retails sector provide buy-now, pay –later offers same way online store also provide same concept over Internet.  Customer provide details of credit card and direct payment would need to be collected by commerce store and a method of indicating to the payment system that the purchase is a deferred credit purchase  Decisions on where the order would lie dormant would need to made. The e-commerce system not holds the information. Therefore the merchant would require some form of authorization check on the consumer’s payment details before the goods were released to the customer.

Multiple payments installments 

Many time customers want purchase product on EMI base. In online store they provide such facility only on debit card. The challenge is how to provide multiple payments installments and how the payment does keeps system track of the regular payments and notify the merchant/consumer of any failures.

Future payments

Following are few other payment options suggested by eCommerce solution provider companies.

E-Money

In credit/ debit card payment transaction, issuing bank charges the merchants a significant fee for each transaction, therefore cards are not good way to sell items for little money. Because of this transaction charge numerous businesses comes in market with special services e-money.

PayPal is successful business that allows people to send money to other people or to merchants without a merchant account with a bank.

Bitcoins and Crypto currencies

Another type of installment getting media consideration as of late is through the utilization of bitcoins or different crypto currencies. A percentage of the primary points of interest progressed for bitcoin are that:

The supply is entirely constrained and not controlled by the government.

Bitcoins are often divided into smaller payments, permitting micro-payments, and

The expense of exchanges are greatly low.

Wireless payments

Payments which are done through wireless device are known as wireless payments.  For example when you want to take dinner in restaurant but you have no money with you at that time. You do, however mobile phones have with you so you can transfer money from mobile using NFC or via your own bank account.

Today two Apple provides this concept through apple pay and Google via Google wallet.

Apple Pay

Apple Pay could be a mobile payment service that lets sure Apple mobile devices build payments at retail and on-line checkout. It digitizes and replaces the credit or debit magnetic tape card group action at MasterCard terminals. The service lets Apple devices wirelessly communicate with purpose of sale systems employing a close to field communication (NFC) antenna, a "dedicated chip that stores encrypted payment information" (known because the Secure Element), and Apple's Passbook and Touch ID.

The administration keeps customer installment information non-open from the distributer, and makes a "dynamic security code [...] produced for each exchange". Apple would not track use, which may keep between the customers, the sellers, furthermore the banks.

Google mobile payment system

This Google Mobile installment framework is in light of the NFC (Near Field Communication), the innovation that permits exchanging data remotely starting with one gadget then onto the next. Furthermore, yes, it bodes well for an organization like Google to make its invasion into this field. The acquiring routine of individuals is completely cherished data for the promoting organizations. These organizations can use the data gathered by Google to market their items and administrations.

Google wallet mobile payments

Google Wallet is a cell phone application that transforms your telephone into a virtual MasterCard/card-less paying gadget Google Wallet will have this image at the clerk:

To pay, you just tap the Google Wallet application on your telephone, punch in a 4-digit PIN code to open it, and touch the telephone to the terminal. This will send a safe installment by means of Near Field Communication (NFC). A Google Prepaid Card is really a virtual card in which you include fiscal trusts from any of your current charge cards.

The New Ways to Pay

 eCommerce solution provider companies suggest following new ways to make payment online.

Twitpay

Using Twtipay, user can transfer money to friend’s paypal account.

Zong

Zong allows customers to provide payment through their phone number instead of credit card details. And the charges reflect on their monthly bill.

Square

Square is ¾ inch cube, which can convert your iPhone into credit card reader.

GetGiving

This mobile application uses for charities to accept small amount donation from public without taking any credit card transaction fee.

Hub Culture

Hub Culture provides users to virtual currency, so they can avoid fees of swapping dollars for rupees.

Electronic payments and their value

If Electronic Payments not exist then

• E-commerce doesn’t exist. It would become very difficult to process online payments for eCommerce solution providers. 
• You can’t purchase product or services online.
• You can’t reserve hotel room or air tickets.
• You can’t perform banking transactions.

Impact of Electronic payment

• A low cost for businesses for software development company.
• A higher exchange of goods and services.
• Transaction can perform easily without geographic boundaries.
• Easy way to manage transactions.
• Unlike cheques, electronic payments don’t ‘bounce’ – as payments will not be effected unless the funds are available in the first place , validation made by payment system development company.

Terminology for Online Payment Systems

• ACH payments
  ACH stands for Automated Clearing House. It provides customers to make payment from their bank accounts by using electronic credit and debit transfers. ACH payments commonly uses for monthly- and subscription-based transactions like online loan repayment, bill payment system developed by software development company. It is used for B2B, B2C and P2P payments.  ACH payments do not provide real time authorization of funds like credit card.

• Merchant Account
  
  A merchant account is a bank account through that customer can receive payments through credit or debit cards. It comes under an agreement between an acceptor and a merchant’s bank for settlement of credit / debit card transactions. In many process it act as merchant account as well as payment gateway.

• Payment Gateway
  
  A payment gateway provides secure way to pass credit/ debit card details to perform transaction between merchants and customer and also between merchant and the payment processor. It comes in middle level between merchant and bank.
• Payment Processor
  
  It is a company which allows merchant to perform credit/debit card transactions. It provides protection from fraud to the customer and merchant.
• PCI compliance
  When payment gateway or merchant starts their working environment, at that time they meet the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is a information security standard for organizations that handle branded credit cards from the major card schemes including American Express, Discover, Visa, and MasterCard.

Payment history

Money Over Time

Credit cards 

It’s not only one way to pay bill with coins and paper currency. To overcome this problem, credit card was introduced more than 60 years ago.  Customers can pay money to merchant via using credit card for products and services. Merchant can take an imprint of customer card and compare sign on receipt with the one on back of card. After validation of card details and verification of customer’s sign, money transfer from customer’s bank account to merchant account. eCommerce solution provider companies can integrate credit cards with ecommerce or any websites easily.

Today companies, hotels, e-Commerce, shops, etc. accept credit card for transfer amount between merchant and customer bank account.

Internet payment 

After Internet became popular, banks and eCommerce solution provider companies realized that money made on the web.  Banks allow customer to perform transaction 24 hours using Internet. Using Internet payment, it is very easy to validate and verify customer details which are stored in web servers. Internet also validates credit/ debit card details, so in the shop customers provide credit card number and expiration date instead of presenting physical card.

Introduction of online payment system

In this era of technology, it is not just to provide informational content by using text and low resolution graphics to attract customers. Customers expect more from a Web site than information on store opening times or pictures of staff and family. Today a visitor to a website will not buy mobile without comparison with same products on other websites and stores; same way customer will not book travel ticket without comparison. eCommerce solution provider companies should consider wide range of factors while designing and developing eCommerce and other websites.
For these services customer can do payment or transaction through credit card, internet payment, wallets, E-money, Bit Coins etc. E-commerce websites have to provide good payment options to customer.

Today it is a challenge to provide fast and secure way to do payments from customer’s account to merchant account.