INTRODUCTION + LITERATURE REVIEW

Since the end of the 20th century, humans begin to witness the dramatic
appearance and rising of applications, devices, companies, organizations, services,
etc, relating to information and technology. Many countries have been and are on
their way to implement the 4.0 industry and soon will be 5.0. In order to adapt to
the new environment some policies have been adopted, among them, the most
concerned and focused on aspect is security. Every year, there are trillions of data
and information are stored or posted online and according to Identity Theft
Resource Center (ITRC), 446,515,334 consumers records containing personal
information were exposed. That is just one common risk, not to mention irruption
in network, data system, accessibility, physical building, etc. So as to modify and
prevent these threats, a security policy is established. It not only helps them outline
all the possible threats and comprehensive solutions. This policy needs to be
updated regularly to fit in the company’s condition and limit sabotage. A good
security policy can greatly contribute to the success of a company. Understand this
issue, this research is conducted to provide comprehensive information about
related problems surrounding the term “security policy”, the policy in the e-
commerce fields in Vietnam in particular, moreover, developing our policy for a
specific case, which is Shopee.
Every organization, regardless the size, needs to have a security policy to
protect its data and valuable assets. According to HM Government, 98% of large
organizations and 60% of small organizations have an information security policy
(HM Government, 2015). Having security strategies and techniques set up will
protect the organization through a proactive policy stance, form the rules for user
behaviors and IT groups, characterize and authorize consequences of violation,
demonstrate a stance on security to minimize hazards and ensures appropriate
compliance with regulations and enactment (Garrett, 2012). The bigger the
enterprise, the more meticulous and secured the policy is. Take Amazon – the
world biggest e-commerce website, its policy to protect the customer data is
thoroughly invested and compiled into 93 white paper pages, it covers every aspect
and cases of security from responsibility model, global infrastructure, access,
accounts feature, security checks to service-specific (Amazon Web Service, 2020).
Almost every issue and risk are detailly listed in the policy along with the quick
solutions and also some suggestions for users to enhance the security of their data.
That is one of the reasons why the Amazon server can hardly be hacked and if it is,
it will be solved in a minimum of time.
Looking back in Vietnam, where e-commerce is growing exponentially, due to the
shopping habits of users, security policy, no doubt, becomes the top concern of
enterprises, government and users. However, there are still approximately 1/3
commercial websites encountering serious flaws (Security Box), which results
from the unawareness and the neglect of the importance of security policy. A
remarkable incident in November 2016 when a branch of VietnamWorks.com was
attacked leading to the expose of thousands of accounts, many of which are linked
with other services, as the result, some banks had to send a warning message to
their customers to ask them to change the password (The Vietnamese Security
Network).
Based on the reference from the previous researches and the current
environment in Vietnam, this paper is organized as follows: Firstly, we discuss the
question “What is security policy?”, secondly we examine and evaluate the
elements and steps to build an optimal security policy and finally putting these
theories into practice by creating our policy. With the hope to raise awareness in
the field of security and set up a more secured policy model for the Vietnamese e-
commerce foundation.
Cite: https://www.idtheftcenter.org/consumers-at-risk-126-increase-in-exposed-
consumer-data-1-68-billion-email-related-credentials/
https://www.pwc.co.uk/assets/pdf/2015-isbs-technical-report-blue-03.pdf
https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf
https://securitybox.vn/966/giai-phap-bao-mat-website-thuong-mai-dien-tu/
https://vsec.com.vn/blog/1/hien-trang-an-toan-thong-tin-trong-thuong-mai
https://www.slideshare.net/charlesgarrett/importance-of-a-security-policy-
11380022