DEVELOPMENT OF A SAFEGUARD MODEL FOR E-TICKETING ABSTRACT

Transcription

1 DEVELOPMENT OF A SAFEGUARD MODEL FOR E-TICKETING June Wei College of Business University of West Florida University Parkway, Pensacola FL (850) jwei@uwf.edu Meiga Loho-Noya College of Business University of West Florida ml24@students.uwf.edu ABSTRACT This paper develops an airline e-ticketing safeguard (ETIS) model. Specifically, the data flow in airline e-ticketing is identified first. Second, an security safeguard model based on resources is developed. Third, a safeguard model for airline e-ticketing is developed by linking the data flow model in e-ticketing with the security safeguard model. This research provides solutions on safeguards for e-ticketing; and therefore, can impact the security research for airline online ticketing. Keywords: e-ticketing, safeguard, privacy, security 1. INTRODUCTION Over the past decade, the development of computer-related technologies and the wide acceptance of the Internet have led to changes in individuals behaviors, as well as in the way business was conducted. Indeed, e-commerce has increased exponentially (Abeyratne, 2005). E-commerce has developed as a new marketplace, creating opportunities for growth for many industries. The air transport industry is one of these industries, as it began using e-ticketing fairly quickly. Replacing traditional paper tickets by electronic tickets has now proven to be an effective commercial practice for organizations operating within the air transport field. Indeed, the e-ticket is a great cost-saving tool as it can lower and even eliminate processes and costs related to printing, postage, shipping, storage, and producing envelopes and ticket jackets. It also decreases the need for airport counter staff and space, which can be replaced by self-service check-ins. Moreover, e-ticketing ensures easier handling of itinerary changes and last-minute travel decisions, and is more convenient to customers as it takes away the risk associated with losing tickets (Williams, 2007). However, as is the case with most changes in the e-commerce field, e-ticketing has brought about issues and concerns about security and privacy (Nemati, 2006). As the International Airline Transport Association (IATA) has just placed its last order for paper tickets, and will move to an all-electronic ticket system by June 2008 (Rosencrance, 2007), it is crucial to ensure all the possible safeguards for privacy and security within the air transport industry are implemented. The purpose of this paper is to develop a safeguard model for security in airline e-ticketing, namely, an airline e-ticketing safeguard (ETIS) model. Previous research on MIS safeguards and e-ticketing has served as a basis to identify the appropriate safeguards concerning e-ticketing.

2 2.1. An Airline E-Ticketing Data Flow Model 2. METHODOLOGY In order to properly identify the safeguards associated with data security in e-ticketing, it seems crucial to clearly understand how e-tickets are sold/purchased, and carefully study the different data flows that usually take place within the selling process for airline e-tickets. Figure 1 shows that there are 8 major types of data flow in e-ticketing: First, airline customers send a request to the airline ticketing server (F1), then they set up or access their account page on the airline ticketing server (F2); the airline server searches different airlines to find flight that corresponds to customer s needs (F3),and the corresponding to customer s needs is retrieved (F4); after that, customers submit payment by providing financial to the airline ticketing sever (F5); the airline ticketing server checks this and is credited with the payment (F6). At this point, customers are sent a confirmation of the purchase to ensure the transaction is correct (F7). Finally, customers can access all the related to their flights through different, personalized Web-pages (F8). Figure 1. E-ticketing data flows To further analyze these data flows, each of these data flows was divided into several tasks, which are described in the following table (Table 1). Flows Tasks Tasks Description F1a Customer makes internet connection F1b Customer enters airline ticketing server s homepage Send F1c Customer designates departure and destination locations request F1d Customer designates dates of travel F1e Customer designates desired flight times F1f Customer designates one way or round trip

3 Access Account Search airline Retrieve flight Submit payment Check payment Purchase confirmed Complete purchase F1g F1h F1i F1j F1k F1l F2a F2b F2c F2d F2e F3a F3b F3c F3d F3e F4a F4b F4c F5a F5b F5c F5d F5e F6a F6b F7a F7b F7c F8a F8b F8c F8d F8e Customer identifies number and ages of passengers Customer identifies any discount codes or frequent flier codes Customer designates class Customer designates special needs requirements Customer designates language of choice Customer is offered rental cars and hotel options Customer signs into account using user id and password If customer has no account an account must be established Customer views account Customer updates account as needed Customer can redeem discount offers Customer can request price Different airline flight is accessed Similar flights are displayed Customer frequent flier options can be used Other airlines can opt to accept customer s frequent flier miles Flights are sorted by price or airline Flights are sorted by different criteria e-ticket or hard copy are offered Different currencies are offered Fees are applied Methods of payment are offered Security verification is required Payment submitted Different credit card choices are offered Different payment instruments are offered Conformation number is issued Travel is sent to the customer Receipt is sent to the customer Online ticket is made available Airport is provided Destination is made available Seat assignments are made available Flight status is made available Table 1. Internet Airline Ticketing Tasks Table 2.2. A Safeguard Model for Information Resource Security Safeguards are protections against security threats. The general model for MIS safeguards involves 3 types of safeguards, as shown on figure 2 (Kroenke, 2006): technical safeguards (related to hardware and software), data safeguards, and human safeguards (they involve procedures or people). Using safeguards of all three types is a good strategy to obtain security and privacy. Therefore, we have tried to identify and define all the safeguards of each type that could allow fighting security threats in e-ticketing. The results appear on Table 2.

4 Hardware Software Data Procedures People Technical Safeguards Data Safeguards Human Safeguards A1 Identification and B1 Data rights and C1 Hiring authorization A2 Encryption A3 Firewalls A4 Malware protection A5 Application design responsibilities B2 Passwords B3 Encryption B4 Backup and recovery B5 Physical security C2 Training C3 Education C4 Procedure design C5 Administration C6 Assessment C7 Compliance C8 Accountability Figure 2: Security Safeguards in Information Resources Safeguard Type Technical Data Human # Safeguard Description A1 Identify and authorize customer using login id and password A2 Customer is protected using up to date encryption technology A3 Program designed to create a barrier between organization and outside intruders A4 Programs designed to detect and protect against viruses, worms and other destructive programs A5 User friendly programs that allow customers to easily conduct business with airlines B1 Protocol designed to define who and why can be accessed B2 Group of alpha numeric characters that allow customer and employees to access data B3 Customer is protected using up to date encryption technology B4 Separate, current and isolated copies of used in case of data loss = Datacenter B5 Protocol that insures only essential employees have access to data C1 Human Resource standards that ensure that bonded personal are placed in sensitive positions C2 Human Resource designed training programs that ensure techniques, standards and procedures are used by new employees C3 Continual training for current employees that ensure new techniques and procedures are used C4 Application designed to ensure that systematic procedures are followed to ensure customer protection C5 Management must set stringent policies to ensure protocol is followed C6 Continuous evaluation of employees to include recommendations for training, advancement, and punitive measures C7 System that ensures all employees follow protocol C8 Employees and management must be held to standards Table 2. Internet Ticketing Safeguards 2.3. An Airline E-Ticketing Model for Information Safeguards The final step in developing our model was to link the identified safeguards to each of the tasks in the e-ticketing data flow. The following table summarizes all the safeguards to be implemented at each level of e-ticketing processes, i.e. each task. It is clear, as stated

5 previously, balancing the three types of safeguards, technical, human, and data, is necessary for best results. Table 3 presents the linkage of the airline e-ticketing data flow model with the safeguard model to develop a model for airline e-ticketing safeguard. In Table 3, each e-ticketing task in the flows has a number of safeguards. Flows Tasks Safeguard # F1a A3-A4-C4-C5-C6-C7-C8 Send request F1b A3-A4-C4-C5-C6-C7-C8 F1c,d,e j,k,l A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 F2a A1-A2-A3-A4-A5-B1-B2-B3-B4-B5 Access Account F2b A1-A2-A3-A4-A5-B1-B2-B3-B4-B5 F2c,d,e A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Search airline F3a,b,c,d,e A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Retrieve flight F4a,b,c,d,e A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Submit payment F5a,b,c,d,e A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Check payment F6a,b A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Purchase confirmed F7a,b,c A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Complete purchase F8a,b,c,d,e A2-A3-A4-A5-B1-B2-B3-B4-B5-C4-C5-C6-C7-C8 Table 3. Internet Ticketing Tasks vs. Internet Ticketing Safeguards 3. DISCUSSION AND CONCLUSIONS This paper developed an airline e-ticketing model by linking an e-ticketing data flow model with an resource safeguard model. The e-ticketing data flow model was built upon the flows of transactions for airline ticket purchases online. The resource safeguard model was built based on an resources model including technical (hardware and software), data, and human (procedure and people) safeguards. The ETIS model developed provides a large picture on e-ticketing safeguards. This research also provides solutions on safeguards for e-ticketing; and therefore, contributes to research on the security for airline online ticketing. From encryption and user authentication, to training programs and specific protocols and procedures, there are many ways to protect data and data flows in the air transport industry, so that the great opportunities created by e-ticketing are not offset by data security and privacy threats. This paper has tried to identify all the possible safeguards for problems threatening Internet ticketing. Thus, this research should provide air transport organizations with a basis for the implementation of a comprehensive security strategy. REFERENCES Abeyratne, R (2005, December 1). Electronic ticketing in air transport--commercial strategies and consequences. Journal of World Trade. Kroenke, D. (2006). Experiencing MIS. New Jersey: Pearson/Prentice Hall. Nemati, H.R. (2006). Editorial Preface. International Journal of Information Security and Privacy.

6 Rosencrance, L. (2007, August 30). Airline body moves toward all-e-ticket system. Computerworld, Retrieved October 25, 2007, from &issueid=119. Williams, L. (2007, September 27). From online to onboard. Computing p.25.