Internet & Intranet Security Management - Risks & Solutions

Risk and Trust
Risk is an essential component of trust; "one must take a risk in order to engage in trusting
action" (Mayer et al, 1995, p. 724). However, "It is unclear whether risk is an antecedent to trust, is
trust, or is an outcome of trust" (Mayer et al, 1995, p. 711). One could argue that risk-taking
behaviour and trust behaviour "are really different sides of the same coin" (Deutsch, 1958, p. 266).
What really matters is that the connection between risk and trust depends on the situation and the
context of a specific, identifiable relationship.
Risk-taking takes into account the probability of the occurrence of an event between parties and the
difference in the anticipated ratio of what Deutsch (1958) calls 'positive and negative emotional
consequences' to the parties. The probability of negative consequences will depend on how risky the
situation is and the existence of security measures that can avoid the risk from happening or reduce
its impact. However, what level of security is adequate is difficult to establish as organisations and
individuals vary considerably from one another in the degree of assurance they require before they
will act in a situation that has the potentiality of danger or negative consequences.
Knowledge of the risk and security processes behind e-commerce appears not to be widespread. Parties
trading on the Internet either take risk and security for granted or assume they are absent. An example
of the latter view is that 'nothing should be sent on the Internet which one would not send by postcard
since the security levels are about the same.' Before examining the security requirements for e-
commerce we outline its major business and technological risks. It should be remembered that risks
don't generally occur in isolation but tend to interact with each other.
Business Risks
As previously stated, e-commerce is a means of exchanging products, services and information over
electronic networks that make up the Internet. The Internet is a non-hierarchical, democraticallystructured,
collaborative arrangement entered into by millions of users. This informality and lack of
overall control creates the perception that the Internet is inherently insecure. As a consequence
business risks arise as follows (Fink, 1998).
• Products and services. The risk exists that products and services ordered on the Internet are not of
the quality promised or are not delivered even though they have been paid for. The buyer may even
deny having placed the order.
• Inadequate legal provisions. Concern currently exists in a number of areas which have not been
adequately defined or tested in law. Questions are asked as to what constitutes an offer and