Abstract:Over the past decade, e-commerce creates exciting new opportunities for business but also brings new web application vulnerabilities and transaction security risks. A stream of news of phishing attacks, website spoofing, payment card skimming (credit /debit cards), fraud in online transactions, malware attack (malicious code attack of viruses, worms, Trojans, and bots), hacker/cracker infiltration, vandalism, identity theft and data breaches of payment card or bank details are increasingly reported. Web application security risk management, therefore, is essential for secure e-commerce online transactions, including order processing, payment transaction, banking and clearing processing. Therefore, the main purpose of this study was to propose a web application security risk management methodology to perform e-commerce web application security risk management, helping organizations understand and improve their e-commerce web application security risks. In order to achieve this purpose, the goal of this study has been two-fold: (1) How will organizations measure threat likelihood, impact consequence and severity of their e-commerce web application security risk? (2) What management methodology is required to prompt the e-commerce web application security vulnerabilities measurement and improvement? Using OWASP Top Ten Vulnerabilities as target items, the proposed management methodology is disciplined in a PDCA based ISO/IEC 27005 iterative process activities, integrating Common Criteria attack potential ratings as threat likelihood scales and the FIPS 199 impact categories as impact consequence scales to categorize severity of every e-commerce web application vulnerabilities. Following the proposed management procedure, all the critical e-commerce web application vulnerabilities can be reviewed, analyzed, prioritized and remedied effectively and efficiently, moving on again in a continuous cycle.

Application and Research for EV SSL Certificate in Electronic Commerce Security and Credit Risk

The Design and Application of Electronic Business Pay System Based on SSL Protocol

FAIR EXCHANGE PROTOCOLS WITH OFF-LINE SEMI-TRUSTED THIRD PARTY

The Research of SSL VPN for WEB Application Based on Electronic Commerce

Research on Security of Application of 2-Dimentional QR Code in Electronic Commerce

The Study on Evaluating Method of the Creditability in Electronic Transaction Platforms

Improved E-commerce Certification Security Using Contract Protocol Based on RSA and DSA Algorithm

A Theory Analysis and Model Research on E-Commerce Credit Risk Management

Model and Method for Evaluating Creditability of C2C Electronic Trade.

Risk evaluation for C2C E‐commerce via an improved credit counting method

Research on E-Commerce Security Issues

Risk and Prevention in E-Commerce Payment

Evaluation and Analysis of Standard Security Technology in V2X Communication -- Exploring ECQV Implicit Certificate Cracking

The Study of Secure Electronic Commerce Solution

Secure remote mobile payment architecture and application

The Application of SSL Protocol in Computer Network Communication

Research and Application of SSL VPN Technology

CA Certification System and Risk Preventing

Cybersecurity Risk Analysis of Electric Vehicles Charging Stations

Online Transaction Security Risk Management for E-commerce Web Applications

Strategies for the Security of Online Payments in E-Commerce