A Framework to Extend COBIT Security Framework to Overcome Confidentiality Threats in Electronic Commerce

Abstract

Confidentiality, integrity, availability, non-repudiation, legitimate use, privacy and auditing of critical information being stored, processed and transmitted between parties involved in electronic commerce are of great importance. The main purpose of this research was to extend COBIT security framework to overcome confidentiality threats in electronic commerce. A descriptive survey research design was conducted to gather primary data. A structured questionnaire was used to collect primary data which was used as the inputs of the proposed framework. The data analysis was done using descriptive statistics using SPSS package. The observations made from this research show electronic commerce faces numerous information security challenges. Confidentiality and privacy issues were the top security issue of concern to the respondent’s with 60.7% of the respondents admitting to it. The study also revealed that the information security approaches used are ineffective and inefficient. Most of the respondents at 96.4% strongly disagreed with the fact that current approaches adopted by our organization are adequate. Further, the respondents disagreed that current approaches adopted by their organization are efficient as the majority at 82.1% disagreeing. Respondents further considered viruses and malicious software at 46.4%, human errors at 28.6% and also system or software errors at 17.9% as the top three main causes of confidential threat their organizations. Further the study revealed 85.7% of the respondents admitted that their organisation did not use any framework in managing information security. In this research, a security framework adopted from COBIT was developed based on the components adapted from integrated system theory coupled with the use of customised approach or hybrid approach. The framework will among other things to provide guidance in the development of effective measures to counter confidentiality threats in electronic commerce. The framework was qualitatively evaluated and not quantitatively through a theoretical evaluation.