Towards a systemic holistic security management

Information System Security and its management ”is a parasite on the profit”. Gerald Kovacich. This thesis presents research intended to modify the understanding of information system security and to introduce information system security not only as a cost factor but also as a business enabler for eCommerce systems. To achieve this, system theoretic concepts will be applied to information security management, taking into consideration the aspects of technology, sociology and business. The first aspects dealt with are security conception and system specification. A set of requirements has been developed for electronic money systems. However, security management consists not only of requirement specifications; it must also allow an economically and socially acceptable implementation. We have thus developed a holistic framework for security management. This framework describes the activities and workflows that lead to satisfactory security levels in eCommerce. To be able to develop an understandable framework we apply black boxing in order to hide details. Two of these black boxes will be described here to motivate the need of inclusion in the framework, where the first deals with the improvement of a risk assessment methodology for faster application in e-commerce and the second with the influence of the Internet on privacy.