The Challenge of Implementing Information Security Standards in Small and Medium e-Business Enterprises
- 1 King Abdulla II School of Information Technology, The University of Jordan, Amman, Jordan
Abstract
The dynamic nature of online systems requires companies to be proactive with thwarting information security threats, and to follow a systematic way for managing and evaluating the security of their online services. The existence of security standards is an important factor that helps organisations to evaluate and manage security by providing guidelines and best practices that enable them to follow a standard and systematic way to protect their e-Business activities. However, the suitability of available information security standards for Small and Medium e-Business Enterprises (e-SME) is worth further investigation. In this paper three major security standards including Common Criteria, System Security Engineering-Capability and Maturity Model and ISO/IEC 27001 were analysed. Accordingly, several challenges associated with these standards that may render them difficult to be implemented in e-SME have been identified.
- Awad, E.M. (2004) Electronic Commerce: From Vision to Fulfilment. 2nd Edition, Prentice Hall, Upper Saddle River.
- Smith, B., Chatfield, V. and Uemura, O. (2001) IBM RedBooks, iSeries e-Business Handbook, A Technology and Product Reference.
- Bakari, J. (2007) A Holistic Approach for Managing ICT Security in Non-Commercial Organisations. A Case Study in a Developing Country. PhD Thesis, Department of Computer and Systems Sciences, SU/KTH Sweden.
- Jennex, M. and Amoroso, D. (2004) e-Business and Technology Issues for Developing Economies: A Ukraine Case Study. The Electronic Journal on Information Systems in Developing Countries.
- Payne, J. (2007) e-Commerce Readiness for SMEs in Developing Countries: A Guide for Development Professionals. Academy for Educational Development/LearnLink.
- Hartono, E., Holsapple, C., Kim, K., Na, K. and Simpson, J. (2014) Measuring Perceived Security in B2C Electronic Commerce Website Usage: A Respecification and Validation. Decision Support Systems, 62, 11-21. http://dx.doi.org/10.1016/j.dss.2014.02.006
- Iglesias-Pradas, S., Pascual-Miguel, F., Hernández-García, A. and Chaparro-Peláez, G. (2013) Barriers and Drivers for Non-Shoppers in B2C e-Commerce: A Latent Class Exploratory Analysis. Computers in Human Behavior, 29, 314-322.
- Wymer, S. and Regan, E., (2005), Factors Influencing e-Commerce Adoption and Use by Small and Medium Businesses. Electronic Markets, 15, 438-453. http://dx.doi.org/10.1080/10196780500303151
- (2007) Common Criteria: An Introduction. http://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R4.pdf
- ISO Security Standards. http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_tc_browse.htm?commid=45306
- Kajava, J., Anttila, J., Varonen, R., Sovola, R. and Roning, J. (2006) Information Security Standards and Global Business. IEEE International Conference on Industrial Technology, Mumbai, 15-17 December 2006, 2091-2095.
- Solms, B. (2001) Information Security: A Multidimensional Discipline. Computers & Security, 20, 504-508. http://dx.doi.org/10.1016/S0167-4048(01)00608-3
- Katsikas, S.K., Lopez, J. and Pernul, G. (2005) Trust, Privacy and Security in e-Business: Requirements and Solutions. Proceedings of the 10th Panhellenic Conference on Informatics (PCI’2005), Volos, 11-13 November 2005, 548-558.