DOI: 10.14489/vkit.2015.03.pp.033-037

Аткина В. С., Оладько А. Ю.
МОДЕЛЬ ОЦЕНКИ БЕЗОПАСНОСТИ СИСТЕМ ЭЛЕКТРОННОЙ КОММЕРЦИИ
(с. 33-37)

Аннотация. Рассмотрена проблема обеспечения информационной безопасности в системах электронной коммерции. Проанализированы основные категории злоумышленников, составлена и описана модель потенциальных угроз безопасности информации в системах электронной коммерции. Выделены этапы реализации атак, представлена модель системы электронной коммерции. Предложен подход к оценке защищенности системы электронной коммерции. Разработан программный комплекс, автоматизи-рующий предложенный подход и приведены результаты экспериментальных исследований, доказывающие его работоспособность и эффективность.

Ключевые слова: система электронной коммерции; информационная безопасность; оценка защищенности; риск.

Atkina V. S., Oladko A. Yu.
MODEL OF E-COMMERCE SECURITY ASSESSMENT
(pp. 33-37)

Abstract. The problem of information security in e-commerce  analyzed. Analyzed the main categories of intruders in e-commerce  systems. All intruders are divided into two types of an internal and an external attacker. For each type of intruder described the objectives, instruments. Level influence on objects e-commerce system is defined. Analyzed and compiled the model of urgent threats to e-commerce systems. For each of the categories identified in the model of information security threats were identified possible attacks that implement this threat. The most dangerous of the attacks were identified sniffing, spoofing DNS / Proxy-servers, Man-in-the-Middle, DDoS -attacks, SQL-injection, theft billing customers and users of e-commerce. The problem of internal audit of information security in e-commerce systems and the problem of choosing the rational composition of information security solutions were considered. To solve the identified problem was proposed approach to assessing the security of e-commerce systems. This approach takes into account the current security threats, their consequences, protection mechanisms and rules for the type of information circulating in the electronic commerce system. It also allows evaluating the potential risks of violation of information security and e-commerce system to assign one of three levels of security. This approach was formally described and automated in the form of software package. Experimental research using the developed software were conducted, proved its efficiency and effectiveness. The conclusion is made about the possibility of applying the proposed approach for the conduct of internal audit of information security in the e-commerce.

Keywords: E-сommerce; Information security; Security assessment; Risk.