Unit 4.4
Management Policies for E-commerce Security
Today's Objectives 🎯
By the end of this chapter, you will be able to:
- ✅ Understand that technology alone is not enough to ensure security.
- ✅ Describe the purpose of a risk assessment.
- ✅ Explain the importance of a written security policy.
Beyond Technology: The Human Element
Technology provides the tools for security (firewalls, encryption, etc.).
But management policies provide the strategy and the rules for people to follow.
Effective E-commerce Security = Technology + Management Policies
🎬 Equifax: Senators’ Criticism
The Three Pillars of Security Management
1. Risk Assessment
Identify & Prioritize Threats
2. Security Policy
Define Rules & Responsibilities
3. Auditing
Verify & Improve Compliance
These three pillars form a continuous cycle of security improvement.
Pillar 1: Risk Assessment 📊
Definition: The process of identifying, analyzing, and evaluating security risks to your organization's assets.
- Goal: Determine the likelihood and potential impact of different threats.
- Outcome: Allows you to prioritize security spending and resources effectively.
- It answers the question: "What should we be most worried about?"
The Risk Assessment Process
- Identify Assets: What are we protecting? (e.g., customer data, payment systems, brand reputation)
- Identify Threats: What can go wrong? (e.g., hacking, malware, employee error, natural disasters)
- Analyze Risks: How likely is it, and how bad would it be? (Likelihood x Impact = Risk Level)
- Prioritize: Focus on high-likelihood, high-impact risks first.
Interactive: Risk Matrix Challenge
Illustrative placements, not universal risks. Impact increases upward; high likelihood is at left, low likelihood at right.
Select a threat below, then click the correct quadrant to place it.
Threats:
Worked Example: Prioritize a Security Control
Illustrative annual estimate for a small online shop: a relevant account-compromise incident has a 20% chance of occurring, with Rs 500,000 expected loss if it occurs.
- Simplified expected annual loss: 0.20 × Rs 500,000 = Rs 100,000.
- A Rs 30,000/year control is estimated to reduce probability to 5%, with the same loss per incident.
- Residual expected loss: 0.05 × Rs 500,000 = Rs 25,000.
What is the estimated annual benefit after paying for the control? What assumptions could change the decision?
Rs 100,000 − Rs 25,000 − Rs 30,000 = Rs 45,000. Estimates are uncertain; legal duties and severe tail risks still matter. An ordinal risk score is not a monetary loss estimate.
An Illustrative Risk Register
Pillar 2: The Security Policy 📜
Definition: A formal, written document that outlines the rules and procedures that must be followed to protect an organization's assets.
It defines who is responsible for security and what actions to take during a security breach.
If it's not written down, it's not a policy—it's just a suggestion.
What's Inside a Security Policy?
Core Components
- Acceptable Use Policy (AUP)
- Password Complexity & Expiration
- Data Handling & Classification
- Incident Response Plan
- Remote Access Rules
Key Questions Answered
- Who can access what data?
- How should sensitive data be stored?
- What happens if a laptop is stolen?
- What are the consequences for violations?
Interactive: Build a Security Policy
Match each policy component on the left to its correct description on the right. Click a component, then click its match.
Policy Component
Description
Policy, Procedure and Access Lifecycle
Policy: the rule
“Production customer-data access requires an approved business need, named accounts and least privilege.”
Procedure: the steps
Manager requests a role → data owner approves → administrator grants scoped access → reviewer checks the evidence.
- Joiner: grant only the access needed for the role.
- Mover/leaver: review changed duties; promptly revoke unnecessary access and sessions.
- Separation of duties: the same person should not request, approve and audit their own privileged access.
A policy states what and why; a procedure explains how and who. Records show whether either was followed.
Joiner–Mover–Leaver
Tabletop: A Customer Database Leak
Illustrative scenario: support receives a sample of customer addresses apparently exported from your shop. In pairs, choose the first actions and assign an owner. Is “delete the logs and restart” a safe response?
- Report and assess: incident lead records what is known and preserves relevant evidence.
- Contain safely: restrict compromised access and involve operations; avoid destroying investigation evidence.
- Investigate and communicate: security, management and legal/privacy roles assess scope and applicable notice duties.
- Recover and learn: fix the cause, validate recovery and track corrective actions.
No to deleting logs. A plan needs decision authority, escalation contacts, evidence handling and exercises—not just a list of tools.
Incident Response Timeline
Pillar 3: Security Auditing 🔍
Definition: A systematic evaluation of an organization's security policies and procedures to ensure they are being followed and are effective.
- An audit is a "health check" for your security program.
- It verifies that the written policy matches real-world practices.
- Identifies gaps, non-compliance, and areas for improvement.
Interactive: Audit Finding Classifier
Training classifications assume a stated policy; 90-day rotation, monthly review and 72-hour notice are not universal best-practice or legal rules. Check current guidance and applicable obligations.
Read each audit finding. Click Compliant or Non-Compliant.
Audit Evidence and Closing the Loop
The policy says departed staff lose production access promptly. An auditor finds an active account belonging to a former employee. What evidence would establish a finding and prove it is fixed?
Evidence
Approved policy, departure record, account permissions, session state and relevant access logs. Minimize unnecessary personal-data exposure.
Corrective action
Named owner, agreed deadline, revoke access/sessions, fix the offboarding workflow and independently retest.
“We sent an email” is not closure. Compare the requirement with observed evidence, then verify remediation. Compliance at one point in time is not a guarantee of future security.
Close the Audit Loop
🎬 Watch: Rehearsing an Incident
Review Policies against Current Guidance
NIST's digital-authentication guidance discourages routine password changes without evidence of compromise and arbitrary character-composition rules. This is guidance with a defined scope, not a universal Nepal law.
- Favor sufficient length, blocked common/compromised passwords, rate limiting and secure password storage.
- Use MFA appropriate to risk; phishing-resistant methods strengthen protection against impersonation.
- Change credentials when compromise is suspected or established, and follow applicable sector/contractual obligations.
Does “changed every 90 days” alone prove an account is secure?
No. Audit against the applicable requirement, and separately evaluate whether that requirement is effective and current.
Practical Application: E-commerce in Nepal 🇳🇵
Scenario: A Nepali Online Marketplace
- Risk Assessment: Might identify fraud on digital wallets (eSewa, Khalti) and DDoS attacks during Dashain sales as high-priority risks.
- Security Policy: Must include a clear policy on handling customer PII (Personal Identifiable Information) to comply with Nepal's privacy laws, like the Privacy Act, 2018.
- Audit: An auditor would check if developer access to the live customer database is properly restricted and if two-factor authentication is enforced for all administrative accounts.
Interactive: Nepal E-commerce Threat Prioritizer
Select a threat, then click a bucket. Severity depends on context; an expired certificate may be urgent.
For a Nepali online marketplace, drag each threat to the correct priority bucket. Select a threat, then click a bucket.
Threats:
Summary & Key Takeaways ⚡
- Holistic Security: Security requires both robust technology and clear management policies.
- Risk-Informed Strategy: A risk assessment is the foundation that guides your security efforts and spending.
- Policy is Paramount: A written security policy is essential for communicating rules, defining responsibilities, and ensuring consistency.
- Continuous Improvement: Regular audits ensure policies are effective and followed, creating a cycle of security improvement.
Interactive: Three Pillars Quick Quiz
Test your understanding of this chapter. Answer all 5 questions.
Let's Discuss
Status update (6 Nov 2026): Sastodeal is DOWN per Arjan; discuss Daraz as the live example, not current Sastodeal operations.
Discussion Questions
- Why is a *written* security policy so much more effective than an unwritten one?
- Who should be involved in creating a company's security policy? (Hint: It's not just the IT department).
- What are some specific things a security audit might look for at an e-commerce company like Daraz?
Exam Practice 📝
Short answer
- Distinguish between a security policy and a security procedure.
- What is a risk assessment?
- What is an incident response plan?
Long answer
- Explain why technology alone is not enough for e-commerce security, and describe the management policies, procedures, and laws that support it, with reference to Nepal.
- Describe the steps in developing an e-commerce security plan, from risk assessment to auditing.
Revise the answers in the full note.
Sources & Media Credits
- Risk register, access lifecycle, incident and audit-loop diagrams: made for IT204, CC BY 4.0.
- Videos: Washington Post; Rapid7.
- Clip 1: source
- Clip 2: source
- Existing course illustrations/logos: retained; creator/licence metadata not supplied (provenance review pending). Sources: Three Pillars of Security; Risk Assessment Matrix; Security Policy Document.
- NIST SP 800-63B-4: authentication guidance
Thank You
Any questions?
Next Topic: Unit 4.5: E-commerce Payment Systems