All Integrated Model for Improving Security Management in the E-Commerce Environment

Security issues and threats in the e-commerce environment are varied and can be caused intentionally and unintentionally by insiders and outsiders. Many experts believe that insiders create the majority of the security threats and issues. Security issues and threats related to ecommerce environment can be categorized as controllable, partially controllable and uncontrollable. This article presents an integrated model that identifies various security issues and threats in the e-commerce environment and then offers a comprehensive e-commerce security plan. The integrated model includes six steps: identification of basic e-commerce security safeguards, identification of e-commerce general security threats, identification of intentional e-commerce threats, identification of e-commerce security measures and enforcements, identification of computer emergency response team services and formation of a comprehensive e-commerce security plan. The integrated model, if carefully followed, should significantly improve the chances of success in keeping the e-commerce hackers and crackers at bay (Bidgoli, 2002). INTRODUCTION Security issues and threats in the e-commerce environment are varied and can be caused intentionally and unintentionally by insiders and outsiders. Security issues and threats related to e-commerce environment can be categorized as controllable, partially controllable and uncontrollable. This article presents an integrated model that identifies various security issues and thieats in the e-commerce environment and then offers a comprehensive e-commerce S'Scurity plan. STEP 1: IDENTIFICATION OF BASIC E-COMMERCE SECURITY SAFEGUARDS Computer hackers and criminals are making national and international news. It's no v/onder that executives in private and public organizations are taking computer and e-commerce security very seriously. A comprehensive e-commerce security system protects customers, buildings, terminals, printers, CPUs, cables, and other hardware and software in an organization. ^/Ioreover, an e-commerce security plan protects data resources, the second most important 119 1 Bidgoli: All Integrated Model for Improving Security Management in the E-C Published by CSUSB ScholarWorks, 2003 Journal of International Techttoloey & Information Management Volume 12, Number 2 resource (after human resources) in an organization. The data resources can be an e-mail message from a division supervisor to the CEO, an invoice being transferred using EDI, the blueprint for a new product design, the outline of a new advertising strategy, the credit card number of a customer or financial statements. Security threats exceed merely stealing data; they include everything from sharing passwords with a co-worker, leaving the system unattended while logged onto the network, to spilling coffee on a keyboard. A comprehensive e-commerce security system includes hardware, software, procedures, customers, and personnel that collectively protect the e-commerce resources and keep intruders and hackers at bay. E-commerce security is broken down into three important aspects: secrecy, accuracy, and availability (Sanders, 1996). Let's briefly explain each aspect. A secret system must not allow information to be disclosed to anyone who is not authorized to access it. In highly secure government agencies (Department of Defense, the CIA, and the IRS) secrecy ensures that only the users who are supposed to have access are granted that access. In business organizations, confidentiality ensures the protection of private information (payroll, personnel, and corporate data). In the e-commerce world, confidentiality ensures that customers' data is protected and will be used only for the intended purpose. Accuracy ensures the integrity of data resources within the organization. This means that the security system must not allow the data to be corrupted or allow any unauthorized changes to the corporate database. Database administrators and webmasters must establish comprehensive security systems for corporate databases. Authorized users must be identified and they must be given proper access privileges. Just imagine that the addition or elimination of a zero would be the difference between $100,000 and $10,000. In e-commerce transactions accuracy and secrecy are important aspects of a security system and they are the prerequisite for any data quality implementation throughout the system. Availability ensures the efficient and effective operation of an e-commerce site and a computer system. In the e-commerce environment availability ensures that the virtual storefront is always available and accessible. A secure e-commerce system must make information available to authorized users. It should also ensure quick recovery of the system to its normal operation in case of a disaster. In many cases, availability is the baseline security need for all authorized users. If the system is not accessible to its authorized users, the secrecy and accuracy objectives of the system cannot be properly assessed. A comprehensive security system in the e-commerce environment must provide three levels of security: • Front-end servers must be protected against unauthorized access. (Level 1) • Back-end systems must be protected to ensure privacy, confidentiality, accuracy and integrity of data. (Level 2) • The corporate network must be protected against intrusion and unauthorized accesses. (Level 3) 120 2 Journal of International Information Management, Vol. 12 [2003], Iss. 2, Art. 9 http://scholarworks.lib.csusb.edu/jiim/vol12/iss2/9 Imvrovine Security Management Journal of Iniernational Technotosv & Information Manaeement I'he goal in designing a comprehensive e-commerce security system is first to design a f au lt tolerance system and then take all the possible measures for protecting the e-commerce data resources (Garfield, 1997). A fault tolerance system is a combination of hardware and software techniques that improves the reliability of an e-commerce site. There are several techniques and tools that can improve the fault tolerance of an e-commerce site. The following are among the po]3u].iir techniques: «i Unint(;rruptible power supply (UPS) Redundant arrays of independent disks (RAID) Mirror disks STEP 2: IDENTIFICATION OF E-COMMERCE GENERAL SECURITY THREATS K-commerce security is concerned with the unauthorized access to important data res our ces Some e-commerce threats are controllable, some are partially controllable, and some are. com]3]etely uncontrollable. Some are intentional while others are made unintentionally (Bidgoli, 2002 and Marion, 1995). Table 1 summarizes several potential e-commerce disasters. Natural Disasters Other Disasters Cold weather Blackouts Earthquakes Fires Floods Gas leaks Hot weather Neighborhood hazards Hurricanes Nuclear attacks Ice storms Oil leaks Ocean waves Power failure Severe dust Power fluctuations Snow Radioactive fallout Tornadoes Structural failure Table 1: Potential E-commerce Disasters Insiders or outsiders intentionally create certain security threats such as the spreading of a computer virus by a hacker or a disgruntled Webmaster. Certain security threats are unintentional, such as, th e eraser of a computer fde or formatting a data disk unintentionally by an employee. Some security Ihieats such as earthquakes are natural and are not controllable (or are partially controllable). A comprehensive e-commerce security system should allow only authorized employees to have access to ecornrnerce facilities. Table 2 summarizes the threats posed by insiders and outsiders.