Selecting Adequate Security Mechanisms in E-Business Processes Using Fuzzy TOPSIS

Security mechanisms are substantial to an e-business environment. While many security mechanisms have been developed to secure e-business processes (EBP) and networks, little attention is given to actual process of a systematic decision making. In most cases strongest security level available is selected. In many cases there are low risks and threats associated with the processes and the use of strong security wastes the available resources. In this paper the authors developed a practical multiple criteria decision making model based on the group fuzzy technique for order preference by similarity to ideal solution (GFTOPSIS) for choosing adequate security mechanism for e-business processes and making a trade-off between security and other important factors in the enterprise. Data was acquired from experts and implemented fuzzy approach. The authors differentiated four phases in the EBP. Each phase of the process which has specific security requirements thus we suggested the use of specified security mechanisms for each phase which improves the efficiency of the system. DOI: 10.4018/ijfsa.2012010103 36 International Journal of Fuzzy System Applications, 2(1), 35-53, January-March 2012 Copyright © 2012, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited. phases. Each phase of the process has specific security requirements. Thus we suggest the use of specified security mechanisms for each phase which improves the efficiency of the system. Decision making to find the adequate security mechanism with regard to the required security level is the problem for which we are seeking a solution in this paper. While many security mechanisms has been introduced to secure devices and networks, too little attention is given to actual decision making process about the security level with respect to predefined requirements (Williams, 2003; Anderson, 2001). Networks and e-business platforms are often faced with a wide spectrum of different security mechanisms e.g., block ciphers, virtual private networks (VPNs), secure socket layer and transport secure layer (SSL/TSL) protocols (Smirnov, 2007). These security mechanisms have different features such as the security level the can provide, costs, implementation ease and complexity, processing speed and computational efficiency, required resources etc. The e-business must decide which security solution to choose in order to satisfy the business needs and policies. In this work we are seeking to make a tradeoff between security level and other important factors in the e-business environment, instead of the “always highest security” approach. The new approach is more efficient and better suites the requirements of the e-business. We develop our framework under the notion of “always best security (ABS)” first introduced by Johnson (2005). According to this approach the strongest security level is not necessarily what we need. Instead we should search for the “best” security level which makes a tradeoff between the criteria to achieve the optimal solution. Decision making under this approach is a complex multiple criteria decision making process. To accomplish the objective of this paper, we modeled the decision making process as a multiple criteria decision making (MCDM) problem which adopts group fuzzy technique for order preference by similarity to ideal solution (GFTOPSIS). The data required to make the decision is obtained from experts and transformed into fuzzy numbers.