Networks, Internet, Cloud and Digital Commerce

Introduction

Modern banking, insurance and finance depend on digital connectivity. A customer may open an account through a mobile application, authenticate through a network service, receive a decision generated in the cloud, and pay through an electronic payment system within seconds. Behind this apparently simple experience are networks, protocols, web technologies, cloud platforms, application programming interfaces (APIs), mobile devices and regulated payment infrastructures.

These technologies create major benefits: wider market reach, faster processing, lower transaction costs, improved information sharing and new business models. They also create dependence on third parties, cyber risk, privacy concerns, service outages and regulatory obligations. Business professionals therefore need more than operational familiarity. They must understand how digital systems work, evaluate their benefits and costs, and make informed decisions about reliability, security and governance.

Learning Objectives

By the end of this chapter, students should be able to:

1. distinguish major network types and explain how data moves across networks;
2. describe important Internet protocols and web technologies;
3. compare cloud service and deployment models;
4. explain mobile computing, APIs and digital payment infrastructure;
5. evaluate business benefits, costs, risks and service implications; and
6. apply these concepts to a banking, insurance or financial-services scenario.

1. Computer Networks and Business Connectivity

A computer network is a set of connected devices that exchange data and share resources. Devices may include computers, servers, smartphones, printers, payment terminals, sensors and security appliances. Communication requires three elements: a transmission medium, agreed rules and addressing mechanisms.

A network's performance is commonly discussed using bandwidth, throughput, latency and availability.

• Bandwidth is the maximum data-carrying capacity of a connection, normally measured in bits per second.
• Throughput is the actual rate achieved after protocol overhead, congestion and other limitations.
• Latency is the time taken for data to travel between endpoints and return when measured as round-trip time.
• Availability is the proportion of time that a service is operational and accessible.

A useful availability relationship is:

Here, service time and downtime must be measured over the same period. The formula assumes that downtime is clearly defined, including whether planned maintenance is excluded. For example, if a payment service is expected to operate for 720 hours in a month and is unavailable for 1.5 hours, availability is approximately 99.79%.

1.1 Network Types

Personal area networks (PANs) connect devices close to one person, such as a smartphone and a wireless headset. Local area networks (LANs) connect devices within an office, branch or campus. A wireless LAN (WLAN) uses radio communication, commonly through Wi-Fi. Metropolitan area networks (MANs) cover a city or large urban region. Wide area networks (WANs) connect geographically separated offices and data centres. The Internet is a global interconnection of networks rather than a single centrally owned network.

A virtual private network (VPN) creates an encrypted logical connection over an underlying network. Banks may use VPNs to connect branches or permit controlled remote access. A VPN improves confidentiality in transit but does not automatically make an endpoint, user or application trustworthy.

Networks may also be classified by ownership and purpose:

1.2 Network Architecture and Security

In a client–server architecture, clients request services and servers process or return information. Centralisation can simplify control, auditing and backup, but it may create concentration risk. Distributed architectures can improve resilience and scalability, but they may be harder to secure and govern.

Network security should be designed in layers. Firewalls control permitted traffic; intrusion detection and prevention systems identify suspicious activity; endpoint security protects devices; identity and access management controls users and privileges; encryption protects data in transit; and logging supports detection and investigation. Segmentation divides a network into zones so that compromise of one area does not automatically expose all systems. For example, a public web server should generally not have unrestricted access to a bank's core transaction database.

The principle of least privilege gives each user or system only the access required for its legitimate task. Zero-trust security extends this idea by requiring continuous verification rather than assuming that a device or user is safe merely because it is inside a corporate network.

2. The Internet and Its Protocols

The Internet operates through layered protocols. A protocol is an agreed set of rules for communication, including message format, addressing, routing and error handling. Layering allows one part of the system to change without redesigning every other part.

The Internet Protocol (IP) provides addressing and routing. IPv4 uses 32-bit addresses, while IPv6 uses 128-bit addresses and provides a much larger address space. IP is generally described as connectionless: each packet is routed independently, and delivery is not guaranteed by IP alone.

The Transmission Control Protocol (TCP) provides reliable, ordered delivery. It establishes a connection, numbers data segments, detects loss and retransmits missing information. User Datagram Protocol (UDP) has lower overhead and does not provide TCP's same reliability mechanisms. It can be useful where speed is more important than guaranteed delivery, such as some real-time communications.

The Domain Name System (DNS) translates human-readable names such as a website domain into network addresses. DNS improves usability but is also a security target. Attacks such as DNS spoofing or manipulation can redirect users to fraudulent destinations.

The Hypertext Transfer Protocol (HTTP) supports communication between web clients and servers. HTTPS is HTTP protected by Transport Layer Security (TLS). TLS provides encryption in transit and helps authenticate the server through digital certificates. HTTPS does not guarantee that the website is honest; it means that the connection is protected and associated with a certificate identity.

Electronic mail commonly uses SMTP for sending messages and protocols such as IMAP for retrieving them. Secure file transfer protocols protect file exchange. In business, the important question is not merely which protocol is used, but whether it provides appropriate confidentiality, integrity, authentication, availability and auditability.

3. Web Technologies and Digital Services

The World Wide Web is an information and application system that operates over the Internet. A browser requests resources from a web server and renders them for the user. HTML defines document structure, CSS controls presentation and JavaScript enables behaviour and interaction.

A static website serves largely pre-prepared content. A dynamic web application generates responses based on users, transactions, databases and business rules. Online banking is a dynamic application because balances, permissions and transaction results differ among customers.

Web applications may be implemented through:

• server-side rendering, where the server produces much of the page;
• client-side applications, where the browser performs substantial processing; and
• hybrid approaches, which combine both methods.

A website's usability is part of service quality. Relevant measures include response time, accessibility, mobile compatibility, error clarity and continuity during high demand. A technically correct application can still fail commercially if users cannot understand it or if the service is unavailable at important moments.

3.1 Cookies, Sessions and Identity

HTTP is stateless: each request is independent. Applications therefore use sessions, tokens or other mechanisms to associate requests with an authenticated user. Cookies can store session identifiers and preferences. Sensitive cookies should be protected with appropriate attributes, including restrictions on transmission and script access.

Authentication verifies identity; authorisation determines what an authenticated person may do. Multi-factor authentication combines different categories, such as something the user knows, possesses or is. A password and a second password are not genuinely different factors. Strong identity management is particularly important for payments, account changes and access to personal data.

4. Cloud Computing

Cloud computing provides on-demand access to shared computing resources, such as servers, storage, networks and software. Resources can often be provisioned rapidly, measured and released with limited manual intervention. Cloud computing does not mean that technology has no physical infrastructure. Data centres, networks and hardware still exist; responsibility is distributed between the provider and customer.

4.1 Service Models

The shared responsibility model is central. A provider may secure its physical data centre and platform, while the customer remains responsible for identity settings, data classification, access rights and lawful use. Exact responsibilities vary by service and contract.

4.2 Deployment Models

A public cloud is operated by a provider for multiple customers. A private cloud is dedicated to one organisation, although it may still use virtualisation and external management. A hybrid cloud combines environments, while a multi-cloud strategy uses services from more than one provider. These models involve trade-offs among control, cost, flexibility, interoperability and complexity.

4.3 Economic and Operational Evaluation

Cloud can reduce upfront capital expenditure and support rapid scaling. It may improve resilience through replicated infrastructure and managed security services. However, usage charges can become unpredictable, data transfer may be expensive, migration may be difficult, and specialised workloads may be cheaper to operate internally over a long period.

A simplified total-cost comparison is:

where TCO is total cost of ownership over the selected period; each C term represents a cost category measured in the same currency and period. This is a decision framework, not a universal pricing formula. A sound analysis includes staffing, training, connectivity, licensing, compliance, backup, outage impact and exit costs.

Cloud service-level agreements (SLAs) should specify availability definitions, support response times, recovery objectives, incident notification, data location, subcontracting, audit rights and termination assistance. Recovery time objective (RTO) is the target maximum time to restore a service after disruption. Recovery point objective (RPO) is the target maximum amount of data, measured in time, that may be lost after recovery. For example, an RPO of 15 minutes means that the organisation aims to restore data to a point no more than 15 minutes before the disruption, subject to the agreed design.

5. Mobile Computing

Mobile computing combines portable devices, wireless networks, applications and location-aware or sensor-based services. Smartphones and tablets support mobile banking, digital wallets, insurance claims, sales force automation and remote work.

Mobile services introduce special design requirements. Screens are smaller, networks may be unreliable, devices may be lost, and applications may operate across different operating systems. Sensitive information should be minimised on the device, stored securely and protected by strong authentication. Applications should support secure updates and should not rely solely on device-based secrecy.

Mobile payments may use near-field communication, QR codes, tokenised card credentials or account-to-account transfers. Tokenisation replaces a sensitive payment credential with a substitute value. A token reduces exposure of the original credential, but security still depends on token management, authentication, device protection and transaction monitoring.

6. APIs and Digital Integration

An API is a defined interface through which one software system requests data or functionality from another. APIs allow banks, insurers, merchants and technology providers to integrate services without exposing their internal implementation.

A typical API interaction contains a request, authentication or authorisation information, parameters and a response. REST-style APIs commonly use HTTP methods such as GET, POST, PUT or DELETE and exchange data in formats such as JSON. Other approaches, including SOAP and event-driven messaging, may be selected where formal contracts, legacy integration or asynchronous processing are important.

Good API design requires:

• clear resource and data definitions;
• authentication, authorisation and encryption;
• input validation and output minimisation;
• rate limiting and abuse detection;
• versioning and backward compatibility;
• idempotency for operations that may be retried; and
• monitoring, documentation and audit logs.

An operation is idempotent when repeating it has the same intended effect as performing it once. Idempotency is vital in payments. If a network timeout occurs after a payment request is accepted, the client should be able to retry safely using a unique request identifier rather than creating a duplicate payment.

Open banking illustrates the strategic importance of APIs. With customer consent and appropriate regulation, authorised third parties may access account information or initiate payments through secure interfaces. This can increase competition and customer choice, but it also raises issues of consent quality, liability, fraud, data minimisation and provider oversight.

7. Digital Payment Infrastructure

Digital commerce depends on coordinated participants. A card payment may involve the customer, merchant, payment gateway, acquiring institution, card network, issuing institution and fraud-monitoring services. An account-to-account payment may involve the payer's bank, a clearing mechanism and the payee's bank.

The main stages of a card transaction are:

1. Authorisation: the issuer or its agent checks credentials, account status, limits and risk signals.
2. Clearing: transaction details are exchanged and obligations are calculated.
3. Settlement: funds are transferred between participating institutions.
4. Reconciliation and dispute handling: records are matched and exceptions, refunds or chargebacks are processed.

A payment system must balance speed, cost, convenience, fraud prevention and finality. Real-time payments provide rapid confirmation but require continuous monitoring, liquidity planning and strong fraud controls. Delayed settlement may permit additional screening but can reduce convenience.

Security mechanisms include encryption, tokenisation, multi-factor authentication, transaction limits, device intelligence, behavioural analytics and anomaly detection. Compliance may involve payment-security standards, consumer-protection rules, anti-money-laundering requirements, know-your-customer procedures, sanctions screening and privacy legislation. The exact obligations depend on jurisdiction and the institution's role.

A digital payment's customer experience includes more than acceptance. Customers care about availability, confirmation speed, transparent fees, dispute resolution and protection from unauthorised transactions. A technically secure system that frequently rejects legitimate customers can cause commercial harm through abandonment and loss of trust.

8. Business Benefits, Costs and Risks

Digital networks and cloud services can produce several benefits:

• Reach: services can be offered beyond physical branches.
• Speed: automated processing reduces manual delay.
• Scalability: capacity can expand during peak demand.
• Integration: APIs connect banks, merchants, insurers and government services.
• Information: logs and transaction data support reporting and risk analysis.
• Personalisation: digital channels can tailor communication and product offers.

The same technologies create risks:

• cyberattacks, malware, credential theft and unauthorised access;
• outages caused by software, networks, suppliers or power failure;
• privacy breaches and inappropriate secondary use of data;
• vendor concentration and cloud lock-in;
• weak APIs, excessive permissions and poor authentication;
• fraud, social engineering and account takeover;
• digital exclusion among customers lacking connectivity or skills; and
• legal uncertainty across jurisdictions.

Risk evaluation should consider likelihood, impact, control effectiveness and residual exposure. Important controls include asset inventories, data classification, secure development, penetration testing, patch management, backups, disaster recovery exercises, supplier due diligence and incident-response plans. Governance must assign accountability; technology does not remove management responsibility.

9. Applied Case: Illustrative Digital Banking Migration

Background

Suppose Regional Bank, a fictional mid-sized bank, operates branch-based systems and an ageing online-banking platform. It wants to launch mobile payments and provide API access to approved fintech partners.

Problem

The existing system has slow release cycles, limited capacity during salary-payment periods and inconsistent authentication. Management is considering a public-cloud migration but is concerned about regulatory compliance, outages, cost escalation and third-party dependence.

Analysis

The bank maps customer journeys and identifies critical services: login, balance inquiry, payment initiation, fraud monitoring and settlement reporting. It classifies customer and transaction data, documents recovery requirements and identifies dependencies on the core banking system and payment networks. It also calculates that a one-hour outage during peak periods could create financial losses, customer complaints and reputational damage beyond the direct technology cost.

Approach and Solution

The bank adopts a phased hybrid architecture. A cloud-hosted API gateway and mobile service layer handle external traffic, while the core ledger initially remains in a controlled environment. All API requests use strong authentication, consent records, rate limits and unique transaction identifiers. Sensitive data is encrypted in transit and at rest. Network segmentation prevents the public-facing layer from directly accessing the ledger.

The bank establishes service metrics, including availability, response time, failed-payment rate, fraud alerts, recovery time and customer complaints. It contracts for incident notification, audit access, data portability and exit support. Before launch, it conducts resilience tests, a security assessment and a controlled pilot with staff and selected customers.

Outcome

The fictional bank gains faster product deployment and improved peak-load handling. However, it discovers that cloud charges rise when poorly optimised logs and data transfers are left unmanaged. It introduces cost budgets, automated alerts and quarterly architecture reviews. The bank also retains a non-digital support channel for customers who cannot use mobile services.

Learning Points

The case demonstrates that migration is a business and governance decision, not merely a technical relocation. Secure interfaces, clear accountability, measurable service levels, supplier controls and inclusive service design are necessary for sustainable digital commerce.

10. Contemporary Developments and Best Practice

Artificial intelligence is increasingly used for fraud detection, customer support, credit assessment and network operations. Its use should be governed by data quality controls, explainability appropriate to the decision, human oversight, bias testing, privacy safeguards and monitoring for model drift. An AI system connected to payment APIs requires especially strong limits because an incorrect automated action can create immediate financial harm.

Edge computing places some processing closer to devices or users, reducing latency and network traffic. Distributed ledgers may support selected forms of shared recordkeeping, but they do not automatically solve identity, governance, scalability or legal-finality problems. Quantum-resistant cryptographic planning is becoming relevant because sensitive data may need protection for many years, although migration timelines depend on standards and risk assessments.

Good practice can be summarised as follows:

1. design services around customer and business outcomes;
2. classify data and apply controls proportionate to sensitivity;
3. use layered security and least privilege;
4. make APIs documented, monitored, versioned and resilient to retries;
5. test backup, recovery and supplier failure rather than assuming resilience;
6. measure total cost, including exit and compliance costs;
7. maintain human support and accessible alternatives;
8. monitor availability, fraud, performance and customer harm; and
9. review legal, ethical and regulatory requirements continuously.

Chapter Summary

Networks provide the connectivity through which modern financial and commercial services operate. LANs, WANs, VPNs, intranets and Internet architectures differ in scope, ownership and control. Protocols such as IP, TCP, DNS, HTTP and TLS provide addressing, transport, naming and secure web communication. Web applications combine HTML, CSS, JavaScript, servers, databases, identity and session mechanisms.

Cloud computing offers elastic, measured access to infrastructure, platforms and software, but responsibility remains shared. Its value must be evaluated against availability, security, compliance, vendor dependence, migration and total cost. Mobile computing extends services to portable devices and requires attention to lost devices, wireless connectivity and secure tokenisation. APIs enable integration and open banking, but require strong authentication, consent, monitoring and idempotent transaction design.

Digital payment infrastructure includes authorisation, clearing, settlement, reconciliation and dispute management. Business benefits such as reach, speed and scalability must be balanced against cyber risk, outages, privacy concerns, fraud, exclusion and regulatory duties. Effective digital commerce is therefore a sociotechnical capability combining technology, governance, people, controls and customer-centred service design.

Key Terms

Network: Connected devices and communication links that exchange data.

LAN: Local area network covering a limited geographic area.

WAN: Wide area network connecting geographically separated locations.

Protocol: Agreed rules governing digital communication.

IP: Internet Protocol used for addressing and routing packets.

TCP: Transport protocol providing ordered and reliable delivery.

DNS: System translating domain names into network addresses.

HTTPS: HTTP protected by TLS encryption and server authentication.

API: Defined interface allowing software systems to communicate.

Cloud computing: On-demand access to shared computing resources.

IaaS: Cloud provision of infrastructure resources such as virtual servers.

PaaS: Cloud platform for developing and running applications.

SaaS: Provider-managed software delivered as a service.

SLA: Agreement specifying service performance and responsibilities.

RTO: Target time for restoring a service after disruption.

RPO: Target maximum period of data that may be lost after disruption.

Tokenisation: Replacement of sensitive data with a substitute token.

Authentication: Verification of a user's or system's identity.

Authorisation: Determination of what an authenticated party may access or do.

Idempotency: Property whereby repeating an operation produces the same intended effect as performing it once.

Review Questions

Short Answer Questions

1. Distinguish bandwidth, throughput and latency.
2. What functions do DNS and HTTPS perform?
3. Compare IaaS, PaaS and SaaS.
4. Why is idempotency important in payment APIs?
5. What are RTO and RPO?

Long Answer Questions

1. Explain how layered network protocols support Internet-based business applications.
2. Evaluate the benefits and risks of migrating a financial institution to cloud computing.
3. Describe the stages of a card payment from authorisation to reconciliation.
4. Discuss security and governance requirements for open banking APIs.
5. Explain how mobile computing changes the design and delivery of financial services.

Analytical / Application Questions

1. A bank is experiencing payment failures during peak demand. Analyse whether the likely solution should involve additional bandwidth, improved application capacity, cloud scaling, or changes to payment processing. Specify the evidence you would collect.
2. Design a control framework for a fintech API that initiates customer payments. Include authentication, consent, rate limiting, idempotency, monitoring and incident response.
3. A cloud provider offers a low monthly price but excludes data-transfer charges, recovery testing and exit assistance. Evaluate the proposal using a total-cost, risk and service-continuity perspective.

Multiple Choice Questions with Answers

Question 1

Which protocol translates a domain name into a network address?

A. DNS

B. TCP

C. SMTP

D. HTML

Correct Answer: A. DNS

Question 2

Which cloud service model gives the customer the greatest responsibility for the operating system and applications?

A. SaaS

B. PaaS

C. IaaS

D. Managed desktop service

Correct Answer: C. IaaS

Question 3

What is the main purpose of TLS in HTTPS?

A. To allocate IP addresses

B. To protect web communication in transit and help authenticate the server

C. To store customer balances

D. To calculate settlement obligations

Correct Answer: B. To protect web communication in transit and help authenticate the server

Question 4

A payment request times out, and the client retries using the same unique request identifier. Which design property helps prevent a duplicate payment?

A. Compression

B. Idempotency

C. Token expiry

D. DNS resolution

Correct Answer: B. Idempotency

Question 5

Which event normally occurs during settlement?

A. A domain name is registered

B. Funds are transferred between participating institutions

C. HTML is rendered by a browser

D. A password is created

Correct Answer: B. Funds are transferred between participating institutions

Question 6

If an agreed service period is 720 hours and downtime is 1.5 hours, availability is closest to:

A. 95.00%

B. 98.50%

C. 99.79%

D. 99.99%

Correct Answer: C. 99.79%

Question 7

What does an RPO of 15 minutes specify?

A. The maximum target time to authenticate a user

B. The target maximum amount of data loss measured in time

C. The maximum permitted API response size

D. The time required to settle every payment

Correct Answer: B. The target maximum amount of data loss measured in time

Question 8

Which control most directly limits the damage caused by excessive user permissions?

A. Least privilege

B. Higher bandwidth

C. Website caching

D. Data compression

Correct Answer: A. Least privilege

Question 9

What is tokenisation in digital payments?

A. Replacing a sensitive credential with a substitute value

B. Converting a website into a mobile application

C. Increasing a network's physical capacity

D. Deleting transaction records

Correct Answer: A. Replacing a sensitive credential with a substitute value

Question 10

Which statement best describes the shared responsibility model in cloud computing?

A. The provider is always responsible for every customer configuration

B. The customer is always responsible for the physical data centre

C. Security duties are divided according to the service and contract

D. Neither party has responsibility for data protection

Correct Answer: C. Security duties are divided according to the service and contract