Previous Page TOC Next Page Home


15

Commerce on the Web

This chapter is a collection of topics that every business person on the Internet will want to understand something about.

Like most things of a technical nature, from astronomy to zoology, learning about the Internet is mostly a matter of coming to grips with its basic terminology. This is also true when it comes to the subject of Internet commerce and cryptography. This chapter serves as a primer of the key terms and definitions in this area. As you can see from the outline above, there are enough three-letter acronyms to make your head spin. But soon you will know enough about the buzzwords to help you develop an effective business plan for the Internet (or at least get you through the day).

Finally, we'll wrap up with some terrific hot spots that you'll want to visit at least once. The business resources mentioned in this chapter were designed and selected to help you succeed in business from almost every conceivable angle. Knowing what's there could pay off for you; and all the information is right at your fingertips.

But first, let's take a look at some of the Internet features that other businesses are already taking advantage of.

What Businesses Are Doing on the Internet

The number one thing that most business people do on the Internet is send and receive electronic mail—instant message delivery anywhere in the world. And having the ability on the receiving end to edit attached data in the same application that created it is what puts e-mail way ahead of voice mail and the fax machine.

Research on the Web is the second most likely way a business person can utilize the Internet. The word research takes on a new meaning on the Web because it is so easy to do. Once you see the resources available, you might not believe your eyes. And no matter what industry you're in, there are golden nuggets waiting to be mined.

Third, read the newsgroups or subscribe to a listserver relevant to your line of business. You may find people who are asking the kinds of questions which your products or services are designed to answer. Be careful about the way you respond to a listserver or newsgroup; they generally don't like companies who plug their own products. You might want to consider sending e-mail directly to the person who posed the question. Also, don't underestimate the newsgroups as an extremely dynamic resource for problem solving and research.

Fourth, consider starting your own listserver for your products. This might work if you let the list take on the atmosphere of a user group and you have enough customers who are interested in keeping each other informed of issues and workarounds in your products. Your organization can simply supply the server for their free use (and you might post an occasional newsletter or press release).

Fifth, and this is the big enchilada, establish your own presence on the Web. The book you hold in your hands has everything you need. Whether you choose to publish marketing literature about your products, take sales orders by electronic forms (eforms), advertise employment openings within your organization, or provide online customer support, the Web will help you advance your business.

Already, some business have reported that 80 percent of their sales are from the Web—although 1–10 percent is more typical. All you have to do is surf the Net to see what other businesses are doing. After awhile, you're bound to formulate some new ideas for your own Web site. If you're in the retail business, for example, you might want to start at the mall.

Shopping Malls on the Web

The terms virtual malls, cyber malls, Internet malls, virtual storefronts, and online malls describe Web sites that give you dozens of links to the home pages of other stores. It's based on the department model found in ordinary malls—for example, appliances, sporting goods, and womens clothing.

Actually, the word virtual seems to be somewhat of a misnomer in describing these stores. After all, they sell real merchandise and really will take your money.

Here are a few of the more established ones. Pardon our lack of enthusiasm (or ignorance), but they all share basic similarities with each other. They do have some interesting nooks and crannies, if you have the time to explore.

Internet Cryptography Standards: DES, RSA, PEM, and PGP

Wow, what a way to change the subject—from shopping malls to cryptography! Well, believe it or not, the two are quite related. On the Web, that is.

Cryptography is an important aspect of security. Chapter 20 takes the perspective of overall security at an Internet site, whereas this section relates more to the security of business data. The purpose of cryptosystems is to render useless the digital data containing credit card numbers and other valuable information in case hackers intercept it between a customer's modem and a business Web server. Some of the world's greatest practical mathematicians have devised these software schemes to guard our private packets on the Net, and still provide us a means to have the data deciphered when it lands in the right hands. What follows is a brief overview of several prevalent standards.

DES

DES stands for the Data Encryption Standard. It was invented by IBM in the 1970s and is widely considered to be very secure. It is estimated that a hacker would have to spend a million dollars and weeks, years, or decades of computer time to break the code.

DES is considered a symmetric cypher because both the sender and the recipient must have the same secret key. The advantage of symmetric cryptosystems is that they are very fast and therefore are useful for large blocks of data.

According to RSA Laboratories, DES is 100 times faster than RSA when both are implemented in software, and up to 10,000 times faster when implemented in hardware.

RSA

RSA gets its name from the fact that it was invented by Ron Rivest, Adi Shamir, and Leonard Adleman. It is a public key (or asymmetric) encryption system.

RSA has also been under the microscope for many years and survived as a very reliable scheme. It is also ideal for use in digital signatures so that the recipient of a message can be certain who sent it. RSA is most useful for small blocks of data, such as the encryption of the secret key to be used in a DES system.

For more information about RSA and a great collection of Frequently Asked Questions about cryptography, including information about digital signatures, see http://www.rsa.com/rsalabs/.

PEM

PEM stands for Privacy Enhanced Mail. Both PEM and PGP use RSA. These programs exist as shareware on the Internet so that you can add them to your mail client or your Web server. PEM hasn't yet enjoyed wide support in the PC world.

PGP

Pretty Good Privacy was invented by Phil Zimmermann. He generously put it on the Internet as a poor-man's alternative to high-priced encryption. His troubles started when someone outside the country downloaded it and the U.S. government decided that Phil had violated weapons export laws because the software used a key-length greater than the allowable limit of 40 bits! PGP is still available for use in the U.S. To our knowledge, the international legal issues have not yet been resolved.

Secure Transactions on the Web: SSL, S-HTTP, STT, and PCT

If your Web site is going to take credit card orders, you will almost certainly want to run a secure Web server. There are many vendors of secure servers, such as Netscape, Open Market, IBM, Internet Factory, SAIC (in beta), and Microsoft (in beta). Most run on Windows NT or UNIX; there are none we know of for Windows 95.

Today, a secure Web server features any or all of the following: S-HTTP, SSL, and STT. However, there is fierce competition among software companies to set the standard for Web servers and browsers.


The Open Market, Inc., home page includes a security checker to determine whether your browser or your server supports secure transactions using S-HTTP or SSL. See http://www.openmarket.com/knowledge/security-watch/index.html.

SSL

SSL stands for Secure Sockets Layer. It was invented by Netscape as a way to encrypt the data that travels at the link layer (or transport layer) between the Web server and the browser. Because Netscape Navigator has been so popular, this has become a de facto standard.

For awhile, it looked like the Web community couldn't decide between using SSL or another standard called S-HTTP. Perhaps because they each operate in a different technical manner and each has its pros and cons, the Web community seems to be moving toward adopting both of them. In a nutshell, the essential difference is that SSL makes the wire secure, whereas S-HTTP makes the documents secure.

S-HTTP

When the HyperText Transfer Protocol and the Web were first conceived, security didn't seem to be much of an issue. Who could have foreseen the enormous potential of the Web for financial data?

S-HTTP stands for Secure-HTTP. S-HTTP builds upon the omnipresence of HTTP by adding new security features. It is a non-proprietary standard.

For more information about S-HTTP, try this URL: http://www.commerce.net/information/standards/.

STT

Just when the Web community seemed to have chosen both SSL and S-HTTP, Microsoft and Visa decided to speak up with the announcement of Secure Transaction Technology (STT).

Although Netscape has always enjoyed the luxury of being out front on the Internet, Microsoft is a software giant probably capable of convincing everyone to adopt its standards instead. Although Microsoft and Visa claim that STT addresses several flaws in the design of SSL, most end users choose their software based on overall quality. Marketing muscle plays a heavy role too. The point is that it is too early to tell which standard, if any, will dominate. We must wait for the market reaction to Netscape Navigator 2.0 and Internet Explorer 2.0.

Internet Explorer 2.0 and a new Windows NT Web server are expected to be available from Microsoft by early 1996, both with support for STT.

Don't count Netscape out; they have Mastercard on their side.

PCT

Yet another acronym that fell out of the Microsoft/Visa partnership, PCT stands for Private Communication Technology. The Microsoft press release claims that it is a separate technology based on some of the algorithms in STT. However, PCT is designed more for the purpose of transmitting secure data of all types, as opposed to purely financial data.

Secure Digital Cash

Most Web server manufacturers offer a secure commerce version of their Web server. The secure Web servers are often an expensive solution to secure commerce. If your individual business transactions on the Web are not large ticket items, it can be expensive to buy a commercial Web server and establish an account with a major credit card company.

There are many other third-party solutions for secure money transactions on the Internet. Most of these work by having the customer make a digital deposit with the bank, before they visit your Web site to spend their ecash. Here is a list of just a few:


With all the recent talk of Internet hackers breaking in and stealing credit card numbers, secure cash is a hot topic. We can't over emphasize how a good security policy and well-configured server will keep you out of trouble in this regard.

For example, don't allow a CGI application that takes credit card information to write that data to a file that is in any directory available to an Internet server application. On Windows NT and UNIX, it is possible and advisable to restrict the user account under which the server is running so it has limited access to the machine. Be aware that this isn't possible on Windows 95, so you will instead rely on the security capabilities of the Web server itself. For example, be sure you don't place any private data in the directories that your Web server will browse.

Internet Business Resources

We have to mention the famous Yahoo again. Try it whenever you are looking for a random or guided tour of the Web: http://www.yahoo.com/Business_and_Economy/.

At the Internet Banking Web site, you will find a white paper that provides a very lucid overview of commerce on the Net. See http://www.sfnb.com/wpaper.html.

The Galaxy Catalog at http://www.einet.net contains very handy links to other resources grouped by category. Among the categories are business, engineering, government, law, and medicine.

The Internet Group has built an online business center that is definitely worth checking out. Their site at http://www.tig.com contains all of the following:

For stock market quotes and analysis, as well as other business data, see http://www.quote.com.

The Accel Partners is a venture capital firm that has prepared informative white papers covering several areas of business financing. Every small business owner should take a look at http://www.accel.com/entreprn.htm.

Charm Net, Inc., has established a Web site that collects dozens of great links to other business resources all under one roof. Most of the links are to well-known resources, but unless you see them all on this page you might not have thought of visiting them. The home page is http://www.charm.net, but if you want to specifically look at the business section, try http://www.charm.net/biz.html.

Here is brief collection of other business resources:

Internet Demographics

The Georgia Tech study of the Internet has really got its act together. They conduct surveys every six months. The last study garnered more than 13,000 respondents. The best part is that they provide more than 200 graphs of the results, and it's all free! Visit their Web site at http://www.cc.gatech.edu/gvu/user_surveys/.

Figure 15.1 is just one example of the colorful bar graphs from Georgia Tech. It shows how people on the Web find out about other Web pages to visit. Not surprisingly, the Web itself accounts for most of the referrals. One interesting point is that friends account for a larger percentage in the USA than in Europe, but Europe makes up for it through the Usenet newsgroups.


Figure 15.1. How users find out about Web pages. © Georgia Tech.

As long as the data is free, why don't we take a look at another example? Figure 15.2 is an interesting chart because it shows that the number one problem people have on the Web is access speed. Would you agree?


Figure 15.2. Problems on the Web from the Georgia Tech survey. © Georgia Tech.

The iVALS project includes an online HTML survey so you can determine your own electronic personality demographically. You can also check out their database of the profiles of other Internet users. See http://future.sri.com/.

Another source of free Internet statistics and demographics is http://www.survey.net/.


The statistic services listed above are free, provided you agree to credit the source as they request.

This list is just the tip of the iceberg. Many of the business resources mentioned above also include information about Internet statistics.

What's Next

We have tried to compile this chapter to serve as the businessperson's quick compendium to the World Wide Web. We hope that you will be able to refer back to it and explore many of the Web pages that are mentioned. It is almost guaranteed that you will find valuable resources tucked away in many of the Web sites mentioned in this chapter.

The next several chapters will help you put this knowledge to work and expand the services that your home page offers. Maintaining your Web site to keep it running in top condition is where we now turn our attention.

Previous Page TOC Next Page Home