A security risk management approach for e-commerce

M. Warren School of Information Technology, Deakin University, Geelong, Australia W. Hutchinson School of Computer and Information Science, Edith Cowan University, Mt Lawley, Australia

Keywords

Electronic commerce, Risk analysis, Information systems

Introduction
Information systems are now heavily utilized by all organizations and relied upon to the extent that it would be impossible to manage without them. This has been encapsulated by the recent development of e-commerce in a consumer and business environment. The situation now arises that information systems are at threat from a number of security risks and what is needed is a security method to allow for these risks to be evaluated and ensure that appropriate security countermeasures are applied.

Abstract

E-commerce security is a complex issue; it is concerned with a number of security risks that can appear at either a technical level or organisational level. This paper uses a systemic framework, the viable system model (VSM) to determine the high level security risks and then uses baseline security methods to determine the lower level security risks.

Security methods
The aim of the research was too combine a information systems modeling method with a baseline security method to form a hybrid security method. This method could be used to evaluate high and low level security risks associated with e-commerce. The methods used in this model are the viable system model (VSM) and baseline security approach. The VSM is used to model an organisation's basic functions and associated data flows, whilst the baseline security approach is used to implement appropriate security countermeasures.

The viable system model (VSM)

Information Management & Computer Security 11/5 [2003] 238-242 # MCB UP Limited [ISSN 0968-5227] [DOI