The program is assessing the level of security of e-commerce

This article deals with the problem of information security in data processing system of e-commerce. The author highlights the scope and the main models of e-commerce. Models type B2E and B2B are selected for the study of security. The main objects that are processed in the system of e-commerce are the payment information, finance, electronic substituents, transaction data, personal data, user's identification and authentication data. The main causes of violations of data security and business continuity in the systems of electronic commerce are analyzed. These are the threat of unintentional and intentional. Unintentional threats include natural disasters and man-made disasters, user errors and software failures. Intentional threats relate to the actions of an insider or an external attacker or group of attackers. The main objects of the impact of the attacker's e-commerce systems are electronic substituents financial resources and personal data. Regulatory requirements to protect payment data and e-commerce systems from the threats of a different nature are allocated. It is concluded that in addition to the use of information security tools necessary to carry out regular monitoring of the security of e-commerce and data processed by it. It is proposed to consider security as a measure of the quality associated with the value of the residual risk by using means of information protection. Security of e-commerce is divided into three levels and describes the scale of L = {low, medium, high}. It is designed and described how the qualitative assessment of the level of security of e-commerce. Its main steps are: - drafting a model of e-commerce with an indication of the objects of protection, protection systems and users; - drafting threat models and risk assessment; - assessment of the security of e-commerce on the basis of data on the means used to protect and risks of the actual threats; - forming a report on the evaluation of security and making recommendations on the reconfiguration of the system of protection in case of need. Functional assessment model of security is composed. The modular architecture of software for the evaluation of the level of protection has been developed and described. The main function modules include: - performance data collection of e-commerce and the input requirements of security and the level of acceptable risk; - selection module remedies designed to select from a list of possible means and mechanisms of protection that are used in the system to ensure safety; - selection module threat and risk assessment system for e-commerce for drawing up the threat model, the settings for each threat and probability of potential damage and the calculation of risk for each threat, and the overall risk; - module security assessment is designed to evaluate the quality level of system security; - generation unit and the recommendations of the report. The graphical user interface is presented. The experimental results of test models of e-commerce systems are described. The author concluded that performance of software and applications as a tool for the assessment of the current security systems, e-commerce and make recommendations for its increase.

Keywords

Authors

References