Cybersecurity, Privacy and Trust

Introduction

E-commerce depends on the ability of customers, merchants, payment providers, logistics firms and regulators to exchange information reliably over networks that are not fully trusted. A customer must believe that a website is genuine, that payment details will not be stolen, that personal data will not be misused, and that an order will be fulfilled as promised. A merchant must protect its systems while preserving usability and availability. Cybersecurity, privacy and trust are therefore not separate concerns: together they form the foundation of digital commerce.

Cybersecurity protects information systems and transactions from unauthorized access, alteration, destruction and disruption. Privacy concerns the appropriate collection, use, disclosure, retention and deletion of information about identifiable people. Trust is the expectation that an actor, system or institution will behave dependably and fairly. Trust is strengthened by technical controls, transparent policies, legal compliance, effective customer service and credible responses when things go wrong.

This chapter examines major e-commerce threats—phishing, account takeover, payment fraud and data breaches—and explains how organizations manage them through encryption, authentication, access control, secure development, PCI DSS practices, privacy-by-design, incident response and business continuity.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain confidentiality, integrity, availability, authentication, authorization, accountability and non-repudiation in e-commerce.
2. Assess phishing, account takeover, payment fraud and data-breach risks.
3. Distinguish encryption in transit, encryption at rest, hashing and tokenization.
4. Design appropriate authentication and access-control measures.
5. Apply secure-development and vulnerability-management principles.
6. Explain the purpose and scope of PCI DSS without treating it as a complete cybersecurity program.
7. Apply privacy-by-design and data-minimization principles.
8. Construct an incident-response and business-continuity approach for an online retailer.
9. Evaluate ethical, legal, managerial and customer-trust implications of security decisions.

1. The Security and Trust Foundations of E-Commerce

A useful security model begins with the CIA triad:

• Confidentiality means that information is available only to authorized parties. Customer addresses, passwords, payment tokens and business pricing data require confidentiality.
• Integrity means that data and processes are accurate and have not been improperly changed. A manipulated product price or shipping address is an integrity failure.
• Availability means that systems and data are accessible when needed. A denial-of-service attack or ransomware event can make an online store unavailable.

The triad must be supplemented by other properties. Authentication verifies identity. Authorization determines what an authenticated identity may do. Accountability links actions to identities and records. Non-repudiation provides evidence that a transaction or message originated from a particular party, although no technical mechanism eliminates all legal disputes.

Security is often described as risk management rather than absolute protection. Risk can be conceptualized as a function of threat, vulnerability and impact:

This is a decision model, not a precise universal law. Likelihood reflects the probability or frequency of a harmful event under defined assumptions; impact includes financial, operational, legal, safety and reputational consequences. Organizations use the model to prioritize controls, recognizing that qualitative scales such as low, medium and high are often more realistic than false numerical precision.

Threats, vulnerabilities and controls

A threat is a potential cause of harm, such as a criminal group, malicious insider or automated bot. A vulnerability is a weakness that can be exploited, such as an unpatched library or weak recovery process. An asset is something valuable, including customer data, payment systems, brand reputation and order records. A control is a safeguard that reduces likelihood, impact or both.

Controls may be:

• Preventive: multifactor authentication, secure coding and network segmentation.
• Detective: fraud monitoring, audit logs and intrusion detection.
• Corrective: credential resets, patching and malware removal.
• Deterrent: warning notices, legal sanctions and visible monitoring.
• Compensating: an alternative safeguard used when a preferred control cannot be implemented immediately.

A mature program uses defense in depth. For example, a stolen password should not by itself permit a high-value refund: multifactor authentication, transaction limits, anomaly detection, approval workflows and audit logs can provide successive barriers.

2. Major E-Commerce Threats

Phishing and social engineering

Phishing deceives a person into revealing credentials, payment information or authorization. Messages may imitate a bank, marketplace, delivery company or internal administrator. Spear phishing targets a particular individual or organization, while smishing uses text messages and vishing uses voice calls. Business email compromise may manipulate employees into changing supplier bank details or issuing refunds.

Technical indicators include mismatched domains, urgent requests, unusual payment instructions, unexpected attachments and links that conceal the true destination. However, sophisticated attacks may use compromised legitimate accounts, realistic branding and accurate personal details. Training is useful but insufficient; technical controls should include phishing-resistant authentication, email authentication standards, safe-link analysis, payment-verification procedures and an easy reporting channel.

Account takeover

Account takeover occurs when an attacker gains control of a legitimate customer or administrator account. Common causes include reused passwords exposed in another breach, credential stuffing, phishing, malware, SIM swapping and abuse of password-reset mechanisms. Consequences include unauthorized purchases, theft of loyalty points, exposure of addresses and fraudulent changes to delivery destinations.

Effective defenses include password screening against known compromised credentials, multifactor authentication, rate limiting, bot detection, device and session monitoring, secure recovery, alerts for profile changes and step-up verification for risky actions. Risk-based controls must be carefully designed: collecting excessive device information may create privacy problems, and denying legitimate customers can produce costly friction.

Payment fraud

Payment fraud includes use of stolen card details, unauthorized digital-wallet payments, refund fraud, triangulation fraud, friendly fraud and transaction laundering. Fraudsters may test small transactions before attempting larger purchases. Merchants must distinguish genuine customer disputes from deliberate misuse while respecting legitimate chargebacks.

Controls include address and identity signals, velocity checks, card-security codes where appropriate, 3-D Secure or equivalent authentication, tokenized payment processing, manual review of exceptional transactions and post-transaction analytics. No individual signal proves fraud. A transaction from a new device is not necessarily fraudulent, and an apparently normal transaction may be part of a coordinated attack. Decisions should combine signals and provide escalation paths.

Data breaches

A data breach is an incident involving unauthorized access to, disclosure of, alteration of or loss of information. Causes include exploitable software, cloud misconfiguration, stolen credentials, insider misuse, insecure APIs, third-party compromise and physical loss. Breach impact depends on the data involved, its sensitivity, the number of people affected, exposure duration and the organization’s response.

Organizations should maintain an accurate data inventory, minimize collection, encrypt sensitive data, isolate systems, patch vulnerabilities, monitor access, test backups and assess suppliers. Logging must be sufficient to investigate without retaining unnecessary personal information indefinitely.

3. Cryptography in E-Commerce

Cryptography transforms information using algorithms and keys so that only authorized parties can read or validate it.

Encryption in transit and at rest

Transport Layer Security (TLS) protects communications between a browser, application and service when correctly configured. It provides confidentiality and integrity in transit and authenticates a server through digital certificates. TLS does not make a compromised endpoint safe, nor does it protect data after an authorized application decrypts it.

Encryption at rest protects stored databases, backups, disks and files. Key management is as important as the encryption algorithm: keys should be generated securely, access should be restricted, rotation should be planned, and recovery procedures should be tested. Storing keys beside encrypted data with identical access permissions substantially reduces protection.

Hashing, passwords and tokenization

A cryptographic hash is a one-way transformation used to detect changes or support indexing. Passwords should not be stored as ordinary hashes alone. They should be processed with a password-specific, deliberately expensive algorithm such as Argon2id, scrypt or bcrypt, using a unique salt for each password. A salt prevents identical passwords from producing identical stored values and makes precomputed attacks more difficult.

Tokenization replaces a sensitive value with a surrogate token. The token is useful within a controlled system but does not mathematically encrypt the original value. A securely managed token vault or provider must protect the mapping. Tokenization can reduce the systems that handle payment-card data, but it does not remove all merchant responsibilities.

Public-key cryptography uses a key pair: a public key may be distributed, while a private key is protected. Digital signatures use the private key to sign and the public key to verify. Symmetric encryption uses the same secret key, or related secret material, for encryption and decryption and is generally efficient for bulk data. Practical systems often use public-key methods to establish a symmetric session key and symmetric methods to protect the session.

4. Authentication, Authorization and Access Control

Authentication factors are commonly classified as:

1. Something the user knows, such as a password or PIN.
2. Something the user has, such as a hardware security key or authenticator device.
3. Something the user is, such as a fingerprint.

Multifactor authentication requires factors from different categories; two passwords are not true multifactor authentication. Phishing-resistant methods, particularly hardware-backed WebAuthn or passkeys, can provide stronger protection than one-time codes copied from text messages. Biometrics are convenient but cannot be changed like a password, so they should be protected as sensitive data and used with careful fallback procedures.

Authorization should follow least privilege: a subject receives only the access necessary for an approved task. Role-based access control assigns permissions to job roles, while attribute-based access control evaluates attributes such as department, transaction value, device state and time. Segregation of duties is important: the employee who creates a refund should not automatically be the only person who approves it.

Session security requires secure cookies, appropriate expiration, protection against session fixation, reauthentication for sensitive actions and revocation after suspected compromise. Administrative access deserves stronger controls, including privileged-access management, separate administrator accounts, just-in-time permissions and detailed logging.

5. Secure Development and Operations

Security should be integrated into the software-development life cycle rather than added immediately before launch. A secure process includes:

• threat modeling during requirements and design;
• secure coding standards and peer review;
• dependency and secret scanning;
• static and dynamic application testing;
• API authorization testing;
• security testing of infrastructure and cloud configurations;
• vulnerability prioritization and timely remediation;
• controlled release, rollback and change management; and
• post-release monitoring and learning.

Threat modeling asks what must be protected, who might attack it, how an attack could occur and which controls are appropriate. A simple data-flow diagram can reveal trust boundaries—for example, between a browser, public API, order service, payment provider and warehouse system.

Developers should validate input, encode output in the correct context, use parameterized queries, protect secrets through a secret manager, avoid sensitive information in logs and implement authorization on the server side. Client-side checks improve usability but cannot be trusted as security controls. APIs should authenticate requests, authorize every object access, enforce rate limits and return no more information than necessary.

Continuous integration can automatically test dependencies and code, but automation does not replace expert review. A vulnerability scanner may identify a known library flaw while missing a business-logic error such as allowing a coupon to be redeemed repeatedly. Penetration testing is valuable when scoped responsibly, but it is a sample of assurance rather than proof of security.

6. PCI DSS and Payment Security

The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard governing environments that store, process or transmit payment-card account data. Its requirements address areas such as network security, secure configurations, protection of stored data, encryption in transmission, vulnerability management, access control, identification and authentication, monitoring, testing and information-security policy.

PCI DSS compliance is not equivalent to being secure. It is a defined control framework with validation obligations and scope considerations. A merchant may reduce scope by using a properly assessed payment service provider and tokenization, but responsibility does not disappear. Contracts, technical integration, shared-responsibility analysis and evidence of provider compliance remain necessary.

A practical PCI-oriented program should:

1. Identify the cardholder-data environment and connected systems.
2. Minimize storage and never retain prohibited authentication data after authorization.
3. Restrict access according to business need.
4. Segment payment systems where appropriate.
5. Monitor access and retain useful audit evidence.
6. Test controls and remediate findings.
7. Train personnel and manage third-party providers.

The exact applicable requirements and validation method depend on the organization, payment channels and current standard version. Organizations should consult the current official PCI DSS materials and qualified assessors rather than relying on outdated summaries.

7. Privacy-by-Design and Data Governance

Privacy is not merely secrecy. It includes appropriate purpose, transparency, individual participation, choice, fairness, security and accountability. Legal duties vary by jurisdiction, but common principles include purpose limitation, data minimization, accuracy, storage limitation, lawful processing and protection against unauthorized use.

Privacy-by-design embeds privacy into architecture, defaults and business processes. A retailer applying it might collect a delivery address only when needed for fulfillment, separate marketing consent from purchase completion, provide clear notices, restrict staff views of customer profiles, delete data according to a documented schedule and offer accessible mechanisms for correction or deletion where law requires.

A privacy impact assessment can examine:

• what data is collected and from whom;
• the purpose and legal or organizational justification;
• data flows and recipients;
• risks to individuals;
• alternatives involving less data;
• safeguards and residual risk; and
• review, retention and deletion arrangements.

Anonymization aims to prevent re-identification, but apparently anonymous datasets may become identifiable when combined with other information. Pseudonymization replaces direct identifiers while preserving a possibility of re-linking. It reduces exposure but remains a privacy safeguard rather than a guarantee of anonymity.

Artificial intelligence creates additional concerns. E-commerce systems may use AI for recommendations, fraud scoring, customer support and personalization. Organizations should evaluate data provenance, accuracy, bias, explainability, human review and security against prompt manipulation or model extraction. Automated fraud decisions should include monitoring for disparate effects and a route for legitimate customers to challenge errors.

8. Incident Response and Business Continuity

No control eliminates all incidents. Incident response is a coordinated capability for preparation, detection and analysis, containment, eradication, recovery and post-incident improvement.

Preparation includes an incident-response plan, roles, contact lists, logging, exercises, legal and communications procedures, forensic readiness and tested backups. Detection and analysis validate alerts, determine scope, preserve evidence and classify severity. Containment limits damage, for example by disabling compromised sessions or isolating a host. Eradication removes malicious persistence and fixes the exploited weakness. Recovery restores trustworthy services gradually while monitoring for recurrence. A post-incident review identifies control and process improvements without unfairly blaming individuals.

Communication must be accurate, timely and coordinated. Customers may need to know what happened, what information was involved, what protective action to take and how to obtain support. Notification duties vary by jurisdiction and sector; legal counsel and relevant authorities should be engaged promptly.

Business continuity asks how critical services will continue during disruption. Disaster recovery is the technology-focused part of restoring systems and data. Two useful planning measures are:

• Recovery time objective (RTO): the maximum acceptable time to restore a service.
• Recovery point objective (RPO): the maximum acceptable amount of data loss measured in time.

For example, an RTO of four hours means the service should be restored within four hours of a defined disruption; an RPO of fifteen minutes means recovery should lose no more than approximately fifteen minutes of transactions, subject to the plan’s assumptions. These are targets, not automatic guarantees. Backups must be protected from ransomware, separated from production credentials, monitored and regularly restored in tests.

9. Illustrative Case: Northstar Marketplace

Background

Northstar Marketplace is a fictional online retailer selling electronics. It uses a cloud-hosted storefront, an external payment gateway, a warehouse API and a customer loyalty program.

Problem

The security team observes a rise in failed logins, unusual loyalty-point redemptions and purchases shipped to newly added addresses. Investigation shows that many customers reused passwords exposed in an unrelated breach. A support employee also receives a convincing message requesting an urgent change to a high-value order.

Analysis

The incident combines credential stuffing, account takeover and social engineering. The business impact includes fraudulent orders, customer frustration, possible exposure of personal data and increased chargebacks. The external payment gateway limits direct card-data exposure, but Northstar still has responsibility for its own systems, integrations and customer accounts.

Approach and solution

Northstar first rate-limits login attempts and invalidates suspicious sessions. It forces resets for affected accounts, screens new passwords against known compromised credentials and introduces passkeys or authenticator-based multifactor authentication. High-risk changes—new delivery addresses, payout details and large refunds—require step-up verification. The company separates support permissions from financial approval, records all sensitive actions and improves alerts for unusual device, location and transaction patterns.

It maps data flows, removes unnecessary loyalty information, shortens retention, reviews its payment-provider responsibilities and conducts a privacy impact assessment. The development team tests authorization at every API object, scans dependencies and adds a threat-model review to major changes. Backups are tested, and an exercise simulates a compromised administrator account.

Outcome

The measures reduce automated takeover attempts and limit the value of compromised passwords. Some customers initially experience friction, so Northstar provides clear explanations, accessible recovery and a staffed support process. The company measures both security outcomes and customer impact rather than treating every blocked transaction as success.

Learning points

The case illustrates that security is socio-technical. Strong cryptography cannot compensate for weak recovery; customer education cannot compensate for absent rate limits; and compliance evidence cannot replace operational monitoring. Effective controls are layered, risk-based, privacy-conscious and tested under realistic conditions.

10. Governance, Ethics and Professional Practice

Security decisions distribute benefits and burdens. Excessive monitoring may reduce fraud while intruding on customers. Aggressive blocking may protect merchants while excluding legitimate users, including people with disabilities or limited access to authentication devices. Ethical practice requires proportionality, transparency, accessibility and avenues for appeal.

Organizations should assign clear accountability to executives, system owners, developers, privacy officers, security teams and suppliers. Policies need measurable ownership, funding and review. Vendor risk management should examine security practices, breach notification, subcontractors, data locations, deletion, audit rights and service continuity. Security professionals must preserve evidence, respect authorization boundaries, disclose vulnerabilities responsibly and avoid unnecessary collection or experimentation on real customer data.

11. Contemporary Developments and Best Practices

E-commerce security is moving toward zero-trust architectures, passkeys, confidential computing, stronger software supply-chain controls, continuous authorization and privacy-enhancing technologies. Zero trust does not mean trusting nobody in an absolute sense; it means making explicit, continuously evaluated decisions rather than granting broad access solely because a request originates inside a network.

A practical baseline for an online retailer is:

1. Maintain an asset, data and supplier inventory.
2. Use phishing-resistant multifactor authentication for administrators and offer it to customers.
3. Apply least privilege, separation of duties and privileged-access monitoring.
4. Encrypt data in transit and at rest, and manage keys independently.
5. Minimize payment and personal-data handling.
6. Patch critical vulnerabilities and manage dependencies and secrets.
7. Log important events, protect logs and test detection.
8. Use layered fraud controls with human escalation.
9. Design privacy into collection, defaults, retention and deletion.
10. Maintain and exercise incident-response, backup and continuity plans.
11. Assess third parties and document shared responsibilities.
12. Measure outcomes, learn from incidents and improve continuously.

Chapter Summary

Cybersecurity, privacy and trust are interdependent foundations of e-commerce. Confidentiality, integrity and availability must be supported by authentication, authorization, accountability and appropriate evidence. Phishing, account takeover, payment fraud and data breaches arise from both technical weaknesses and human or organizational failures. Layered controls—including encryption, secure password storage, phishing-resistant authentication, least privilege, fraud analytics, secure development and monitoring—reduce risk but do not eliminate it.

PCI DSS helps protect payment-card environments, but it is not a complete security strategy. Privacy-by-design requires purpose limitation, minimization, transparency, retention control and safeguards throughout the data life cycle. Incident response and business continuity prepare organizations for inevitable failures through containment, recovery, tested backups and clear communication. Effective e-commerce security is therefore a continuing governance activity involving technology, people, suppliers, law, ethics and customer experience.

Key Terms

Account takeover: Unauthorized control of a legitimate user account.

Authentication: Verification of an identity claim.

Authorization: Determination of which actions or resources an authenticated subject may access.

Availability: Accessibility of systems and information when required.

Business continuity: Capability to continue critical operations during and after disruption.

Confidentiality: Protection of information from unauthorized disclosure.

Encryption: Transformation of readable information into protected ciphertext using a key.

Hashing: One-way transformation used for integrity checks and other security functions.

Incident response: Organized process for detecting, containing, resolving and learning from security incidents.

Integrity: Protection against unauthorized or improper alteration.

Least privilege: Granting only the access necessary for an authorized task.

Multifactor authentication: Authentication using factors from at least two different categories.

PCI DSS: Payment Card Industry Data Security Standard for payment-card data environments.

Phishing: Deception intended to obtain information or induce an unauthorized action.

Privacy-by-design: Integrating privacy safeguards into systems, processes and defaults from the outset.

Recovery point objective: Maximum acceptable data loss expressed as a time interval.

Recovery time objective: Maximum acceptable time to restore a service.

Threat modeling: Structured analysis of assets, threats, trust boundaries and controls.

Tokenization: Replacement of sensitive data with a surrogate token.

Vulnerability: A weakness that can be exploited to cause harm.

Review Questions

Short Answer Questions

1. What are the three components of the CIA triad?
2. Why is tokenization different from encryption?
3. Define least privilege and give one e-commerce example.
4. What is the purpose of an RPO?
5. Why does PCI DSS compliance not guarantee complete cybersecurity?

Long Answer Questions

1. Explain how phishing can lead to account takeover and propose layered preventive and detective controls.
2. Compare encryption, hashing and tokenization in the context of customer and payment data.
3. Describe the main phases of incident response and explain how communication should be managed.
4. Explain how privacy-by-design changes the collection, use and retention of e-commerce data.
5. Discuss how secure software development and third-party risk management support customer trust.

Analytical / Application Questions

1. An online retailer sees repeated failed logins followed by successful logins from unfamiliar devices and delivery-address changes. Analyze the likely attack, identify evidence to collect and design an immediate response.
2. A company wants to retain all customer browsing, identity and purchase data indefinitely to improve AI recommendations. Evaluate this proposal using data minimization, purpose limitation, security, fairness and governance principles.
3. A payment service provider processes card data, while the merchant stores customer profiles and order records. Map the likely shared responsibilities and recommend controls that reduce both payment risk and privacy risk.

Multiple Choice Questions with Answers

Question 1

Which property of the CIA triad is primarily violated when an attacker changes a customer’s delivery address?

A. Confidentiality

B. Integrity

C. Availability

D. Non-repudiation

Correct Answer: B. Integrity

Question 2

Which control most directly reduces the risk that a stolen password alone will enable account takeover?

A. Multifactor authentication

B. Longer product descriptions

C. Daily sales reports

D. Open network access

Correct Answer: A. Multifactor authentication

Question 3

What is the main purpose of a unique salt in password storage?

A. To recover the original password

B. To make identical passwords produce identical hashes

C. To make precomputed and comparison attacks more difficult

D. To encrypt database backups automatically

Correct Answer: C. To make precomputed and comparison attacks more difficult

Question 4

Which statement best describes tokenization?

A. It replaces sensitive data with a surrogate value

B. It guarantees that data can never be re-identified

C. It is identical to password hashing

D. It removes all obligations under PCI DSS

Correct Answer: A. It replaces sensitive data with a surrogate value

Question 5

What does the principle of least privilege require?

A. Every employee receives administrator access

B. Users receive only the access necessary for authorized tasks

C. Access is granted permanently after first login

D. Customers may access internal audit logs

Correct Answer: B. Users receive only the access necessary for authorized tasks

Question 6

A recovery point objective of 15 minutes indicates:

A. The service must be restored within 15 minutes

B. The organization may lose no more than approximately 15 minutes of data

C. Backups must be retained for 15 minutes

D. Users must authenticate every 15 minutes

Correct Answer: B. The organization may lose no more than approximately 15 minutes of data

Question 7

Which statement about PCI DSS is most accurate?

A. It replaces the need for incident response

B. It applies only to employee passwords

C. It is a payment-card security standard, not a complete cybersecurity program

D. It guarantees that no payment fraud can occur

Correct Answer: C. It is a payment-card security standard, not a complete cybersecurity program

Question 8

Which practice is most consistent with privacy-by-design?

A. Collecting every available data field for possible future use

B. Using privacy-protective defaults and collecting only necessary data

C. Retaining all data indefinitely

D. Hiding data practices in complex legal language

Correct Answer: B. Using privacy-protective defaults and collecting only necessary data

Question 9

Which incident-response activity focuses on limiting ongoing damage?

A. Containment

B. Marketing

C. Product cataloguing

D. Data monetization

Correct Answer: A. Containment

Question 10

Why should authorization be enforced on the server side in an e-commerce API?

A. Client-side code cannot be modified by attackers

B. Server-side checks prevent reliance on untrusted client behavior

C. It eliminates the need for authentication

D. It makes encryption unnecessary

Correct Answer: B. Server-side checks prevent reliance on untrusted client behavior