Section: Software Development Security

The TLS Protocol is comprised of the TLS Record and Handshake Protocols. The TLS Record Protocol is layered on top of a transport protocol such as TCP and provides privacy and reliability to the communications. The privacy is implemented by encryption using symmetric key cryptography such as DES or RC4. The secret key is generated anew for each connection; however, the Record Protocol can be used without encryption. Integrity is provided through the use of a keyed Message Authentication Code (MAC) using hash algorithms such as SHA or MD5. The TLS Record Protocol is also used to encapsulate a higher-level protocol such as the TLS Handshake Protocol. This Handshake Protocol is used by the server and client to authenticate each other. The authentication can be accomplished using asymmetric key cryptography such as RSA or DSS. The Handshake Protocol also sets up the encryption algorithm and cryptographic keys to enable the application protocol to transmit and receive information.

Secure Electronic Transaction (SET). Originated by VISA and MasterCard as an Internet credit card protocol using digital signatures. SET operates at the application layer which distinguishes it from SSL. SSL operates at the Transport layer. Secure Electronic Transaction (SET) is a system for ensuring the security of financial transactions on the Internet. It was supported initially by Mastercard, Visa, Microsoft, Netscape, and others. With SET, a user is given an electronic wallet (digital certificate) and a transaction is conducted and verified using a combination of digital certificates and digital signatures among the purchaser, a merchant, and the purchaser's bank in a way that ensures privacy and confidentiality. SET makes use of Netscape's Secure Sockets Layer (SSL), Microsoft's Secure Transaction Technology (STT), and Terisa System's Secure Hypertext Transfer Protocol (S-HTTP). SET uses some but not all aspects of a public key infrastructure (PKI).
Here's how SET works:
Assume that a customer has a SET-enabled browser such as Mozilla or Microsoft's Internet
Explorer and that the transaction provider (bank, store, etc.) has a SET-enabled server.
The customer opens a Mastercard or Visa bank account. Any issuer of a credit card is some kind
of bank.
The customer receives a digital certificate. This electronic file functions as a credit card for online
purchases or other transactions. It includes a public key with an expiration date. It has been
through a digital switch to the bank to ensure its validity.
Third-party merchants also receive certificates from the bank. These certificates include the
merchant's public key and the bank's public key.
The customer places an order over a Web page, by phone, or some other means.
The customer's browser receives and confirms from the merchant's certificate that the merchant is
valid.
The browser sends the order information. This message is encrypted with the merchant's public
key, the payment information, which is encrypted with the bank's public key (which can't be read
by the merchant), and information that ensures the payment can only be used with this particular
order.
The merchant verifies the customer by checking the digital signature on the customer's certificate.
This may be done by referring the certificate to the bank or to a third-party verifier.
The merchant sends the order message along to the bank. This includes the bank's public key, the
customer's payment information (which the merchant can't decode), and the merchant's certificate.
The bank verifies the merchant and the message. The bank uses the digital signature on the
certificate with the message and verifies the payment part of the message.
The bank digitally signs and sends authorization to the merchant, who can then fill the order.
Reference(s) used for this question:
Mc Graw Hill, Shon Harris, CISSP All In One (AIO) Book, Sixth Edition, Pages 856-858
and
What is Secure Electronic Transactions (SET) by SearchFinancialSecurity
and
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of
Computer Security, 2001, John Wiley & Sons, Pages 89, 170.

Section: Mixed questions
Explanation/Reference: http://ssae16.businesscatalyst.com/SSAE16_reports.html