Madrock

Hi,

I have been putting some secure application development documents together recently and have found some good general tutorials and guidelines which I thought I would post here.

Best Practices

• The Ten Most Critical Web Application Security Vulnerabilities, 2004 Update, The Open Web Application Security Project. URL: http://www.owasp.org/documentation/topten
• A Guide to Building Secure Web Applications, The Open Web Application Security Project. URL: http://www.owasp.org/documentation/guide
• Improving Web Application Security: Threats and Countermeasures, Microsoft MSDN. URL: http://msdn.microsoft.com/library/default.asp?url=/library/enus/dnnetsec/html/ThreatCounter.asp
• Authentication in ASP.NET: .NET Security Guidance, Microsoft MSDN. URL: http://msdn.microsoft.com/library/default.asp?url=/library/enus/dnbda/html/authaspdotnet.asp
• Session Fixation Vulnerability in Web-Based Applications, ACROS Security. http://www.acros.si/papers/session_fixation.pdf
• Writing Secure Code, Michael Howard and David LeBlanc, Microsoft Press.
• Threat Modelling, Window Snyder, Microsoft Press.
• 10 Things You Shouldn’t Do with SQL Server (Data Access Developer “Don’ts”) http://www.dotnetjunkies.ddj.com/Article/86F0988E-FED4-414F-BA2E-D01D953C11BE.dcik
• Ten dos and don’ts for secure coding http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1172049,00.html
• Cross Site Scripting http://www.cert.org/archive/pdf/cross_site_scripting.pdf http://www.acunetix.com/websitesecurity/cross-site-scripting.htm
• The Cross Site Scripting (XSS) FAQ http://www.cgisecurity.com/articles/xss-faq.shtml
• XSS (Cross Site Scripting) Cheat Sheet http://ha.ckers.org/xss.html
• SQL Injection Cheat Sheet http://ha.ckers.org/blog/20070315/sql-injection-cheat-sheet/

Other Resources

• AusCERT is the national Computer Emergency Response Team for Australia http://www.auscert.org.au/
• SANS Institute http://www.sans.org/free_resources.php

I was asked some time ago what sort of things may be considered when looking at Internet Banking.

Below is a list of things which could be considered. It was just a brain dump and as such may not be complete.

Don’t underestimate the value of standard for your infrastructure, website configuration,  database engine configuration/architecture,staging environment and development/QA environments.

Some thoughts:

• Many don’t lock accounts after X failed logins, this is normally done for good customer service, but leaves the system vulnerable.

- And all the other things expected for a remote login session (forced password changes, aging, etc))
- Tools such as Brutus may be use to brute force hack authenticated sessions.

• Many allow session sequence numbers to be incremented, allowing an authenticated user to view other customer session.

- These may be server side, client side, cookie based, etc.
- Get someone to check the development methodologies and the code being used.
- Database query strings can be placed into test entry fields, allowing table dumps to browser.
- Check all pages served are secure and contain user authentication flags.

• Customer data may not be segregated, this needs to be checked.
• Customer data should not reside on the Web Server.

• Authentication databases / system data should not reside on the webserver.
• The databases should reside on a private/semi-private network.

- A different segment to the main banking system.

• Webserver should be dual homed or equivalent (some VLAN techniques are good)

- Separate private and public network cards, monitoring/backup/administration
- Infrastructure set-up to explicitly deny inbound/outbound ports, private IP & monitoring escaping from the network.

• At all data segregation points ensure rules are in place which appreciates the traffic though that point.

• All customer data where possible should be sourced from a secure back-end database.

- This may be a staging environment. i.e. no the main banking system.
- This usually allows for transactions to appear real time to the customer.
- Many transactions may be batched in reality. (internal or external to the bank)

• Ensure suitable rules have been set-up on firewalls.

- There should be inbound and outbound rules on firewalls and filtering routers.

• Don’t allow any infrastructure on the front end to allow remote administrative connections. (telnet, etc.)

- Use the serial console port to connect to a server or back-end terminal server.

• Look for the segregation / staging of online customer content from main banking systems

• Ensure that a separate development / QA / production environment system and suitable process is in place.

• Services not used by the system are active

- These should be disabled.

• Port scan of the supporting infrastructure (routers /switches) and server(s).

- Investigate the reasons for all open ports.

• Don’t use the main gateway for trusted partner access (clearing / RAS / etc.)
• Do all that standard IIS checks and NT checks (Sample scripts, change management, patching methodologies, etc.)
• Ensure denial of service precaution have been taken into account for all infrastructure and server equipment.
• Check the adequacy of the escalation procedures used.

- Look for real-time monitoring and alerting.
- Look for responsibility matrix.
- Look for ownership of issues.

• Consider upstream carrier(s) vulnerability (denial of service, IP spoofing, DNS hacking, etc)
• Consider social engineering of customer, administrative, partner accounts / systems / infrastructure.

- Helpdesk procedures and policies and/or alternate technologies (Caller ID, Gateway IP, etc.).

• Use dynamic passwords where possible (SecureID, TACACS, etc.).
• Use encrypted tunnelling where needed (IPSec, Firewall 1, etc)
• Consider looking at other customer authentication methods to enhance existing methods.

- Digital cert, IP address locked to account, etc.
- Consider use of CVV or CVN for bank issued cards.

• Consider how passwords are distributed /changed for customers.

- Plain text email, telephone, etc.
- Can passwords be changed online?

• Is additional authentication used between sections of the services once authenticated?
• Consider what the customer has access to once authenticated.

- Look at SWIFT, RTGS, inter-bank transfers, access to credit cards, etc.
- If an attacker does get in, what can the do?

• Use techniques to ensure pages, customer details are not cached at ISP, or client system.

- These are flags that can be set within pages.
- Normally SSL is cached, but some proxy vendors have been playing with techniques to do so.
- Caching of SSL pages on the client system can be turned on on some browsers.
- May banks use a Java (or similar) applet for all customer interaction, restricting all caching issues.

• Ensure paper based and on-line liability clauses are available are address all effected areas.
• Ensure within the customer sign-up process banking liability is reduced.

- I’ve seen statements like “use this system at your own risk, responsibility for any liability or claim will NOT……”
- Not very customer focused, but that’s what their legal department recommended.

All of the above can effect the security and/or operation of an on-line banking system.

Other things to consider:

• External development and support of the application.
• Ownership and management of the hardware/applications
• Publishing points for new content (internal/private/trusted network or Internet)
• Topology of front end.  i.e. Security Architecture document should be in place and managed appropriately.
• Are limited AP tests performed whenever changes are made to the environment? i.e. integrated AP into Change management process.
• Database access. Is it buffered or is it live to the core banking systems.
• What facilities are provided? Direct debit + Credit Card + SWIFT + ……. Consider different scenarios for your attack depending on the feature.
• What other services are shared within the network segment that the Internet Banking service is running. Can this be used to compromise the Internet Banking site. eg. different support/business/development organisations with differing security strategies/profiles.
• Consider all external supporting services within you AP. Look at internal/external DNS poisoning opportunities, mail relay, etc. What IPS’s do they use has the ISP any opportunity to access systems or supporting services which may affect Internet Banking.
• Depending on the size of the Bank, many organisation do not use the same support groups for infrastructure and the application. As a result external connections to the infrastructure may be provided for an external support organisation to administer the infrastructure.
• Look at the business and user authentication methods and paths (client side certs, secure ID, SMART Card, etc). Consider two factor authentication and modern user identification methods. eg. what is your favourite food in addition to normal usernames and passwords. Do system administration staff use dynamic passwords (secureID, etc)?
• See if the Internet Banking application sends email to users which may contain interesting information.
• Better access to the application can generally be gained after access to the system. i.e. get an legitimate account on the system. I have found that some sample/administration screens have been restricted to authenticated users only.
• Consider social engineering the Help desk to have an account password reset.

This has been kept under wraps by the Operating System and Hardware vendors for the last few weeks and now patches have finally been released for many Operating Systems, DNS software applications and Hardware devices.
If you provide or rely on DNZ services (external and Internal) you should consider quickly patching your servers/devices.

Although Internal DNS servers may not be exposed to an Internet attack, we see many more internal attacks within larger organisations which involve rogue server or services being established within the firewalled trusted network. As a result, this lifts the threat level of internal systems/services and therefore the need for effective timely patching.

Also consider asking the question of your hosting facility, upstream ISP or DNS provider to see if they have patched their DNS servers and forwarders.

http://www.doxpara.com/?p=1162 This link also has a DNS checker.
http://afp.google.com/article/ALeqM5hwFqcnWAuDWlcqfvfyHu5PGG9RMQ
http://www.kb.cert.org/vuls/id/800113

This is a full list of vendor patch links
http://www.betanews.com/article/Major_fix_to_DNS_vulnerability_impacts_Windows_Debian/1215551008

Good Luck

I found a list of useful Cisco commands which I though I would post here. When I get a chance I will continue to expand the list and broaden command set.

Thanks to the fastget2you.com Joined With #missomhack Community for the original list.

ROUTER COMMANDS :

• Config# terminal editing - allows for enhanced editing commands
• Config# terminal monitor - shows output on telnet session
• Config# terminal ip netmask-format hexadecimal|bit-count|decimal - changes the format of subnet masks

HOST NAME:

• Config# hostname ROUTER_NAME

BANNER:

• Config# banner motd # TYPE MESSAGE HERE # - # can be substituted for any character, must start and finish the message

DESCRIPTIONS:

• Config# description THIS IS THE SOUTH ROUTER - can be entered at the Config-if level

CLOCK:

• Config# clock timezone Central -6
  # clock set hh:mm:ss dd month yyyy - Example: clock set 14:13:00 25 August 2003

CHANGING THE REGISTER:

• Config# config-register 0×2100 - ROM Monitor Mode
• Config# config-register 0×2101 - ROM boot
• Config# config-register 0×2102 - Boot from NVRAM

BOOT SYSTEM:

• Config# boot system tftp FILENAME SERVER_IP - Example: boot system tftp 2600_ios.bin 192.168.14.2
• Config# boot system ROM
• Config# boot system flash - Then - Config# reload

CDP:

• Config# cdp run - Turns CDP on
• Config# cdp holdtime 180 - Sets the time that a device remains. Default is 180
• Config# cdp timer 30 - Sets the update timer.The default is 60
• Config# int Ethernet 0
• Config-if# cdp enable - Enables cdp on the interface
• Config-if# no cdp enable - Disables CDP on the interface
• Config# no cdp run - Turns CDP off

HOST TABLE:

• Config# ip host ROUTER_NAME INT_Address - Example: ip host lab-a 192.168.5.1
  -or-
• Config# ip host RTR_NAME INT_ADD1 INT_ADD2 INT_ADD3 - Example: ip host lab-a 192.168.5.1 203.23.4.2 199.2.3.2 - (for e0, s0, s1)

DOMAIN NAME SERVICES:

• Config# ip domain-lookup - Tell router to lookup domain names
• Config# ip name-server 122.22.2.2 - Location of DNS server
• Config# ip domain-name cisco.com - Domain to append to end of names

CLEARING COUNTERS:

• # clear interface Ethernet 0 - Clears counters on the specified interface
• # clear counters - Clears all interface counters
• # clear cdp counters - Clears CDP counters

STATIC ROUTES:

• Config# ip route Net_Add SN_Mask Next_Hop_Add - Example: ip route 192.168.15.0 255.255.255.0 205.5.5.2
• Config# ip route 0.0.0.0 0.0.0.0 Next_Hop_Add - Default route
  -or-
• Config# ip default-network Net_Add - Gateway LAN network

IP ROUTING:

• Config# ip routing - Enabled by default
• Config# router rip
  -or-
• Config# router igrp 100
• Config# interface Ethernet 0
• Config-if# ip address 122.2.3.2 255.255.255.0
• Config-if# no shutdown

IPX ROUTING:

• Config# ipx routing
• Config# interface Ethernet 0
• Config# ipx maximum-paths 2 - Maximum equal metric paths used
• Config-if# ipx network 222 encapsulation sap - Also Novell-Ether, SNAP, ARPA on Ethernet. Encapsulation HDLC on serial
• Config-if# no shutdown

ACCESS LISTS:

IP Standard	1-99
IP Extended	100-199
IPX Standard	800-899
IPX Extended	900-999
IPX SAP Filters	1000-1099

IP STANDARD:

• Config# access-list 10 permit 133.2.2.0 0.0.0.255 - allow all src ip’s on network 133.2.2.0
  -or-
• Config# access-list 10 permit host 133.2.2.2 - specifies a specific host
  -or-
• Config# access-list 10 permit any - allows any address
• Config# int Ethernet 0
• Config-if# ip access-group 10 in - also available: out

IP EXTENDED:

• Config# access-list 101 permit tcp 133.12.0.0 0.0.255.255 122.3.2.0 0.0.0.255 eq telnet
  -protocols: tcp, udp, icmp, ip (no sockets then), among others
  -source then destination address
  -eq, gt, lt for comparison
  -sockets can be numeric or name (23 or telnet, 21 or ftp, etc)
  -or-
• Config# access-list 101 deny tcp any host 133.2.23.3 eq www

-or-

• Config# access-list 101 permit ip any any
• Config# interface Ethernet 0
• Config-if# ip access-group 101 outIPX STANDARD:
• Config# access-list 801 permit 233 AA3 - source network/host then destination network/host

-or-

• Config# access-list 801 permit -1 -1 - “-1″ is the same as “any” with network/host addresses
• Config# interface Ethernet 0
• Config-if# ipx access-group 801 outIPX EXTENDED:
• Config# access-list 901 permit sap 4AA all 4BB all
  - Permit protocol src_add socket dest_add socket
  -”all” includes all sockets, or can use socket numbers

-or-

• Config# access-list 901 permit any any all any all
  -Permits any protocol with any address on any socket to go anywhere
• Config# interface Ethernet 0
• Config-if# ipx access-group 901 inIPX SAP FILTER:
• Config# access-list 1000 permit 4aa 3 - “3″ is the service type

-or-

• Config# access-list 1000 permit 4aa 0 - service type of “0″ matches all services
• Config# interface Ethernet 0
• Config-if# ipx input-sap-filter 1000 - filter applied to incoming packets

-or-

• Config-if# ipx output-sap-filter 1000 - filter applied to outgoing packets

NAMED ACCESS LISTS:

• Config# ip access-list standard LISTNAME
  -can be ip or ipx, standard or extended
  -followed by the permit or deny list
• Config# permit any
• Config-if# ip access-group LISTNAME in
  -use the list name instead of a list number
  -allows for a larger amount of access-lists

PPP SETUP:

• Config-if# encapsulation ppp
• Config-if# ppp authentication chap pap
  -order in which they will be used
  -only attempted with the authentification listed
  -if one fails, then connection is terminated
• Config-if# exit
• Config# username Lab-b password 123456
  -username is the router that will be connecting to this one
  -only specified routers can connect

-or-

• Config-if# ppp chap hostname ROUTER
• Config-if# ppp chap password 123456
  -if this is set on all routers, then any of them can connect to any other
  -set same on all for easy configuration

ISDN SETUP:

• Config# isdn switch-type basic-5ess - determined by telecom
• Config# interface serial 0
• Config-if# isdn spid1 2705554564 - isdn “phonenumber” of line 1
• Config-if# isdn spid2 2705554565 - isdn “phonenumber” of line 2
• Config-if# encapsulation PPP - or HDLC, LAPD

DDR - 4 Steps to setting up ISDN with DDR Configure switch type

1. Config# isdn switch-type basic-5ess - can be done at interface config

2. Configure static routes
Config# ip route 123.4.35.0 255.255.255.0 192.3.5.5 - sends traffic destined for 123.4.35.0 to 192.3.5.5
Config# ip route 192.3.5.5 255.255.255.255 bri0 - specifies how to get to network 192.3.5.5 (through bri0)

3. Configure Interface
Config-if# ip address 192.3.5.5 255.255.255.0
Config-if# no shutdown
Config-if# encapsulation ppp
Config-if# dialer-group 1 - applies dialer-list to this interface
Config-if# dialer map ip 192.3.5.6 name Lab-b 5551212
connect to lab-b at 5551212 with ip 192.3.5.6 if there is interesting traffic
can also use “dialer string 5551212″ instead if there is only one router to connect to

4. Specify interesting traffic
Config# dialer-list 1 ip permit any
-or-
Config# dialer-list 1 ip list 101 - use the access-list 101 as the dialer list

5. Other Options
Config-if# hold-queue 75 - queue 75 packets before dialing
Config-if# dialer load-threshold 125 either
-load needed before second line is brought up
-”125″ is any number 1-255, where % load is x/255 (ie 125/255 is about 50%)
-can check by in, out, or either

Config-if# dialer idle-timeout 180
-determines how long to stay idle before terminating the session
-default is 120

FRAME RELAY SETUP:

• Config# interface serial 0
• Config-if# encapsulation frame-relay - cisco by default, can change to ietf
• Config-if# frame-relay lmi-type cisco - cisco by default, also ansi, q933a
• Config-if# bandwidth 56
• Config-if# interface serial 0.100 point-to-point - subinterface
• Config-if# ip address 122.1.1.1 255.255.255.0
• Config-if# frame-relay interface-dlci 100
  -maps the dlci to the interface
  -can add BROADCAST and/or IETF at the end
• Config-if# interface serial 1.100 multipoint
• Config-if# no inverse-arp - turns IARP off; good to do
• Config-if# frame-relay map ip 122.1.1.2 48 ietf broadcast
  -maps an IP to a dlci (48 in this case)
  -required if IARP is turned off
  -ietf and broadcast are optional
• Config-if# frame-relay map ip 122.1.1.3 54 broadcast

SHOW COMMANDS

• Show access-lists - all access lists on the router
• Show cdp - cdp timer and holdtime frequency
• Show cdp entry * - same as next
• Show cdp neighbors detail - details of neighbor with ip add and ios version
• Show cdp neighbors - id, local interface, holdtime, capability, platform portid
• Show cdp interface - int’s running cdp and their encapsulation
• Show cdp traffic - cdp packets sent and received
• Show controllers serial 0 - DTE or DCE status
• Show dialer - number of times dialer string has been reached, other stats
• Show flash - files in flash
• Show frame-relay lmi - lmi stats
• Show frame-relay map - static and dynamic maps for PVC’s
• Show frame-relay pvc - pvc’s and dlci’s
• Show history - commands entered
• Show hosts - contents of host table
• Show int f0/26 - stats of f0/26
• Show interface Ethernet 0 - show stats of Ethernet 0
• Show ip - ip config of switch
• Show ip access-lists - ip access-lists on switch
• Show ip interface - ip config of interface
• Show ip protocols - routing protocols and timers
• Show ip route - Displays IP routing table
• Show ipx access-lists - same, only ipx
• Show ipx interfaces - RIP and SAP info being sent and received, IPX addresses
• Show ipx route - ipx routes in the table
• Show ipx servers - SAP table
• Show ipx traffic - RIP and SAP info
• Show isdn active - number with active status
• Show isdn status - shows if SPIDs are valid, if connected
• Show mac-address-table - contents of the dynamic table
• Show protocols - routed protocols and net_addresses of interfaces
• Show running-config - dram config file
• Show sessions - connections via telnet to remote device
• Show startup-config - nvram config file
• Show terminal - shows history size
• Show trunk a/b - trunk stat of port 26/27
• Show version - ios info, uptime, address of switch
• Show vlan - all configured vlan’s
• Show vlan-membership - vlan assignments
• Show vtp - vtp configs

CATALYST COMMANDS
For Native IOS - Not CatOS

SWITCH ADDRESS:

• Config# ip address 192.168.10.2 255.255.255.0
• Config# ip default-gateway 192.168.10.1DUPLEX MODE:
• Config# interface Ethernet 0/5 - “fastethernet” for 100 Mbps ports
• Config-if# duplex full - also, half | auto | full-flow-control

SWITCHING MODE:

• Config# switching-mode store-and-forward - also, fragment-free

MAC ADDRESS CONFIGS:

• Config# mac-address-table permanent aaab.000f.ffef e0/2 - only this mac will work on this port
• Config# mac-address-table restricted static aaab.000f.ffef e0/2 e0/3
  -port 3 can only send data out port 2 with that mac
  -very restrictive security
• Config-if# port secure max-mac-count 5 - allows only 5 mac addresses mapped to this port

VLANS:

• Config# vlan 10 name FINANCE
• Config# interface Ethernet 0/3
• Config-if# vlan-membership static 10TRUNK LINKS:
• Config-if# trunk on - also, off | auto | desirable | nonegotiate
• Config-if# no trunk-vlan 2
  -removes vlan 2 from the trunk port
  -by default, all vlans are set on a trunk port

  CONFIGURING VTP:

• Config# delete vtp - should be done prior to adding to a network
• Config# vtp server - the default is server, also client and transparent
• Config# vtp domain Camp - name doesn’t matter, just so all switches use the same
• Config# vtp password 1234 - limited security
• Config# vtp pruning enable - limits vtp broadcasts to only switches affected
• Config# vtp pruning disableFLASH UPGRADE:
• Config# copy tftp://192.168.5.5/configname.ios opcode - “opcode” for ios upgrade, “nvram” for startup config

DELETE STARTUP CONFIG:

• Config# delete nvram

I have been recently working inside one of the larger Banks in Australia.
Through this work I have been looking at the controls and mechanisms surrounding the processing of credit and debit cards around the Asia Pacific.

I get perform many security architecture and payment systems assessments.
Over the years I have always considered the protection of the card data as one of the key considerations.

Until yesterday I had never seen an CVV or PVV decryption tools. I think some scripted use of these tools could be very interesting.
The site hziggurat29.com

Many of the other tools on this site are also very unique and worth a look.
Big thanks to ziggurat29 for providing such awesome tools.

As many of these sites are of this nature are difficult to find and often seem to vanish over the years, I have chosen to replicate the the text from this page and provide local copies on the files.
It is worth periodically visiting the ziggurat29 site every now and again to see if any additional tools have been posted.

One of the more extraordinary files is the Atalla Hardware Security Module (HSM)  and BogoAtalla for Linksys emulation (simulation) tools. So I wonder if Eracom and Thales are shaking in their boots. Some how I don’t think so. ;-)

——– ziggurat29 Text ———

These are all Windows command-line utilities (except where noted); execute with the -help option
to determine usage.

DUKPT Decrypt (<- the actual file to download)

This is a utility that will decrypt Encrypted PIN Blocks that have been produced via the DUKPT triple-DES method.  I used this for testing the output of some PIN Pad software I had created, but is also handy for other debugging purposes.

VISA PVV Calculator (<- the actual
file to download)

This is a utility that will compute and verify PIN Verification Values that have been produced using the VISA PVV technique.  It has a bunch of auxiliary functions, such as verifying and fixing a PAN (Luhn computations), creating and encrypting PIN blocks, decrypting and extracting PINs from encrypted PIN blocks, etc.

VISA CVV Calculator (<- the actual file to download)

This is a utility that will compute Card Verification Values that have been produced using the VISA CVV technique.  MasterCard CVC uses the CVV algorithm, so it will work for that as well.  It will compute CVV, CVV2, CVV3, iCVV, CAVV, since these are just variations on service code and the
format of the expiration date.  Verification is simply comparing the computed value with what you have received, so there is no explicit verification function.

Atalla AKB Calculator (<- the actual file to download)

This is a utility that will both generate and decrypt Atalla AKB cryptograms.  You will need the plaintext MFK to perform these operations.  When decrypting, the MAC will also be checked and the results shown.

BogoAtalla (<- the actual file to
download)

This is an Atalla emulator (or simulator).  This software emulation (simulation) of the well-known Atalla Hardware Security Module (HSM) that is used by banks and processors for cryptographic operations, such as verifying/translating PIN blocks, authorising transactions by verifying
CVV/CSC numbers, and performing key exchange procedures, was produced for testing purposes.  This implementation is not of the complete HP Atalla command set, but rather the just
portions that I myself needed.  That being said, it is complete enough if you are performing acquiring and/or issuing processing functions, and are using more modern schemes such as Visa PVV and DUKPT, and need to do generation, verification, and translation.

This runs as a listening socket server and handles the native Atalla command set.  I have taken some liberties with the error return values and have not striven for high-fidelity there (i.e., you may get a different error response from native hardware), but definitely should get identical positive
responses.  Some features implemented here would normally require purchasing premium commands, but all commands here implemented are available.  Examples are generating PVV values and encrypting/decrypting plaintext PIN values.

BogoAtalla for Linksys (<- the actual file to download)

This is the Atalla emulator ported to Linux and build for installation on an OpenWRT system.  Makes for a really cheap ($60 USD) development/test device.

 

Local Files

bogoatalla002
atallaakbcalc
bogoatalla_10-1_mipsel
dukptdecrypt
visacvvcalc
visapvvcalc

Acquiring Institution
The Financial Institution which holds the Merchant Account partaking in a financial transaction, typically the first bank involved in the processing of a payment.

Applet
A small computer program which facilitates the performance of particular tasks.

Bandwidth
The capacity of a server to carry or process information. The higher the bandwidth the faster graphics-laden web pages will download.

Browser
Short for Web browser, a software application used to locate and display Web pages. The two most popular browsers are Netscape Navigator and Microsoft Internet Explorer. Both of these are graphical browsers, which means that they can display graphics as well as text. In addition, most modern browsers can present multimedia information, including sound and video, though they require plug-ins for some formats.

Caching
The automatic copying and storage of frequently used information onto a computer system – Typically caching is seen whilst surfing the internet (graphics, etc.) and used by Internet Services Providers (ISP’s) to reduce the amount of data requested from the user onto the internet.

Issuer
The Financial Institution which issued the cardholder’s account and card.

Cardholder
The individual participating in the financial transaction whose card is being credited or debited.

Card Verification Data
The additional information printed on the card to be processed. This is used to verify if the card was present when the transaction was initiated.  This is the additional digits imprinted on the card usually on the reverse side for VISA & Mastercard and on the front for AMEX.

Certificate
An x.509 certificate used to authenticate entities such as Merchants and Payment Gateways. Certificates can be used to identify and/or encrypt sensitive data such as card numbers and personal cardholder information.

CGI
Common Gateway Interface: A protocol that allows a Web page to run a program on a Web server. Forms, counters, and guest books are common examples of CGI programs.

Any piece of software can be a CGI program if it handles input and output according to the CGI standard. Usually a CGI program is a small program that takes data from a web server and does something with it, like putting the content of a form into an e-mail message, or turning the data into a database query. CGI “