Security analysis and the DSM model

This paper mainly discusses security analysis in Web-based information systems. The analysis focuses on current client/server system application environments and system vulnerabilities. The paper also briefly describes a proposed conceptual security model-dual security model (DSM). The model focuses on risk management by identifying possible attacks on the system and addressing them before they can impact significantly system security and business of the organisation. The key design feature of this model is developing a high level risk assessment framework for analysing and evaluating the system environment, interrelated system functions, risk modelling and the evaluation process in Web-based information systems.

1. Introduction

In the age of the Internet and World Wide Web, system security is one of the most important issues in any global web-based business information systems. This is confirmed by the strong of commitment from system security professionals, research community and major business application software vendors. The types of impacts include losses in productivity, revenue, customer confidence, stock price and other negative results. Recent denial of service attacks, viruses, computer intrusions, hackers and insider activities have cost companies millions of dollars. In a recent computer crime survey, respondents from 273 U.S. corporations, government agencies, financial institutions, medical institutions and universities reported losses totalling over $265 million [1]. The most serious financial losses occurred through theft of proprietary information and financial fraud. As the rapid growth of Internet access, the adoption of the Internet by businesses and the increased global competition, the financial and political impacts of these incidents will increase and security threats cannot be avoided.