DRSA: A New Framework for Reliability Audit of Electronic Transaction Document Security in Electronic-Based Government Information Systems in Indonesia

This study references several prior literature studies, particularly those related to the development of an audit model for the reliability of electronic document and transaction security systems in Indonesia's Electronic Based Government System (EBGS). The scope of the literature review includes data security and electronic transactions, Trustmark implementation, audit models and security standards, and the implementation of electronic-based government systems in Indonesia.

2.1 Data security and electronic transactions

Data security and electronic transactions are significant concerns in today's digital age. The theories underlying this field include several vital principles. First, the confidentiality model emphasizes the importance of keeping information inaccessible to unauthorized parties. Integrity ensures that data remain accurate and unaltered without authorization, while availability ensures that information is always accessible when needed [10]. Research conducted by Kautenburger [11] identifies potential risks and challenges in maintaining information security during transactions. Key findings highlight security challenges in electronic transactions and the importance of proactive measures to protect user data.

Personal data protection is another critical issue as governments increasingly collect and process large amounts of personal information. Research conducted by Sarjito [12] explores and evaluates the challenges faced by governments regarding personal data protection. The study's findings underscore that continuous evaluation and improvement of data protection frameworks are essential for maintaining effectiveness in addressing evolving security challenges.

Effective security control requires management to first examine the organization's security level. Existing criteria for evaluating the security level are often limited to external security risks and have inappropriate cut-off points for addressing the security risks that can merge and increase within an organization. In their paper, Kim et al. developed a security evaluation model that focuses on the risk of information leakage from within the organization [13]. The findings of this study include 26 detailed evaluation items that consider security requirements to prevent technical information leakage.

2.2 Trustmark implementation

Implementing Trustmark in information system security is an important step toward increasing user trust in digital services. Trustmark also enhances transparency by providing information regarding the security measures taken, privacy policies, and data handling procedures [14].

Öksüz et al. [15] discussed how trust can be transmitted through technology and how the trust relationship between users and technology providers can be understood. Their critical finding is that trust is a crucial factor in managing users' risk perceptions when using digital technology. Users must feel confident that technology and service providers can be trusted to protect their data and privacy.

Thompson et al. [16] studied how the use of trust marks affects consumer trust and consumer risk perception, and consequently, their purchase intentions. The study found that trust marks can increase consumer trust and purchase intentions while reducing the risk of online transactions. Recent advances in sensor technology and communication device have significantly improved information systems (IS). However, the security of these devices and the trustworthiness of the information they produce cannot be guaranteed. These objects are vulnerable to fraud or control by malicious third parties, presenting new challenges regarding the level of trust one can have in the data, sensors, and information systems themselves. Costé et al. [17] proposed considering information system security assurance through trust assessment, providing new insights into the relationship between information system security and user trust.

2.3 Audit models and security standards

Audit models and security standards are essential for managing risk and ensuring the integrity of information systems, especially data security [18]. The audit model evaluates and assesses the effectiveness of security controls implemented in an organization [19]. Security standards ensure that organizations implement best practices in protecting their data and systems. These standards provide explicit references for preventing threats and vulnerabilities and ensuring compliance with applicable regulations [20].

Several commonly used information system audit models, include COBIT (Control Objectives for Information and Related Technologies), which was developed by ISACA to help organizations manage and control information and technology by providing comprehensive guidance on risk management and compliance. In addition, ISO/IEC 27001 is an international standard that specifies requirements for an information security management system (ISMS); audits based on this standard assess the implementation of policies and controls to protect sensitive information. Another relevant model is the NIST (National Institute of Standards and Technology) SP 800 series, which provides guidelines for risk management and information security with a focus on proper risk assessment. ITIL (Information Technology Infrastructure Library) also plays a role in security audits, though it focuses more on IT service management, helping organizations manage standardized IT services. Furthermore, SABSA (Sherwood Applied Business Security Architecture) emphasizes the importance of integrating security into the business architecture, while the Risk IT framework, also developed by ISACA, combines risk management with IT management. Each model has a different approach and focus, but overall, they aim to ensure that information systems remain secure, efficient, and compliant with applicable regulations. Selecting the suitable audit model depends on the specific needs of the organization, the risks it faces, and its business objectives.

Regulating IT utilization in both central and regional governments (EBGS) brings numerous benefits or value to the organization but also presents various problems and obstacles. In his research, Novianto [21] developed a Control Objective for Information and Related Technology (COBIT) framework model to determine the level of maturity in the information technology governance process.

Effective information technology (IT) governance has a significant impact on overall performance and outcomes. The COBIT framework, currently known as COBIT 2019, is widely adopted by IT auditors to assess IT governance in organizations. However, a comprehensive understanding of IT governance also requires assessing organizational culture as part of the audit approach. Wijanarko et al. [22] analyzed the application of the COBIT 2019 framework to improve IT performance. Their study found that applying the COBIT 2019 framework, especially in the DSS (Deliver, Support, and Service) domain, can identify several deficiencies in IT governance performance. The researchers recommend developing an IT governance strategy tailored for each service provider to meet user requirements and comply with the maturity level set by COBIT 2019.

ISO/IEC 27001 is an international standard that specifies requirements for an information security management system (ISMS) [23]. This standard is designed to help organizations manage and protect their sensitive information in a structured and systematic way. ISO/IEC 27001 covers a wide range of aspects, from identifying, assessing, and managing information security risks, to developing the necessary policies and procedures to protect data. However, despite ISO 27001 providing a strong framework for managing information security risks, its implementation is not always smooth.

Kitsios et al. [24] found that many companies with ISO 27001 certification do not periodically document their operational procedures. This oversight results in numerous information security risks that remain unrecognized and unaddressed.

Cybersecurity threats continue to evolve, necessitating a strong and mature cybersecurity posture for organizations. Irawan et al. [25] proposed a cybersecurity maturity assessment framework design that utilizes two established standards: the Cybersecurity Framework (CSF) v1.1 from the National Institute of Standards and Technology (NIST) and Controls v8 from the Center for Internet Security (CIS). Based on the results of mapping NIST CSF to CIS Controls v8, 44 NIST CSF and 108 subcategories of NIST CSF are mapped to 124 sub controls of CIS Controls v8. This integration is categorized into each NIST CSF function: identify, protect, detect, respond, and recover. This study recommends further research to identify additional frameworks to fill in unmapped NIST subcategories.

Tanjung et al. [26] conducted similar research, designing information security in electronic government systems using NIST CSF 2.0, ISO/IEC 27001:2022, and CIS Control. This study found that applying the three frameworks, NIST CSF 2.0, ISO/IEC 27001:2022, and CIS Controls v8, resulted in 22 elements that can be combined to improve information system security for government agencies.

Information protection and cybersecurity are challenging tasks for all organizations. Cyber attacks can damage reputation, brand, stakeholder satisfaction, business operations, and result in financial losses. Jayanthi [27] proposed a systematic approach to information security strategic planning using the Defense in Depth (DID) mechanism. The findings in his study highlight the importance of reengineering information security and integrating it into an organization's data governance strategy to mitigate cybercrime threats. Organizations must invest adequate time in developing a mature and forward-looking information security strategic plan that addresses both internal and emerging external threats.

Organizations often face various cyber attacks daily, necessitating regular audits. However, there is currently no integrated tool to perform the typically expensive and time-consuming task of cyber security audits. Al-Matari et al. [28] developed a cybersecurity framework to conduct cybersecurity audit processes within organizations. The proposed framework clarifies security issues through output reports that identify cybersecurity gaps. In addition, this framework helps practitioners in developing integrated tools to support cybersecurity auditors in securing organizations and finding mechanisms to carry out cybersecurity audit tasks effectively.

2.4 Implementation of electronic-based government systems in Indonesia

The rapid development of Electronic Government Systems (ESGs) has significantly improved the efficiency and accessibility of public services. However, the increasing reliance on these systems has also raised concerns about their security and the potential impact of security incidents on government operations and citizen trust.

Prastowo and Sudiana [29] proposed a framework for handling security incidents using the ISO/IEC 27035:2023 standard on information security incident management at the Ombudsman of the Republic of Indonesia. The findings indicated a probability score of 3, an impact score of 5, and a risk level of 22 (Very High). A root cause analysis revealed that the root cause of the risk was the absence of an incident response plan.

Another challenge to implementing the EBGS in Indonesia is the issue of interoperability and the lack of human resources trained in information technology. A study conducted by Akbar et al. [30] identified six dominant themes that need full attention: interoperability, governance, services, technology, information systems, and frameworks.

Figure 2 illustrates the proposed framework model for auditing the reliability of securing electronic transaction documents. As shown in Figure 1, the audit process for evaluating the reliability of electronic system documentation within an EBGS is based on three basic principles of data security and electronic transactions: confidentiality, integrity, and availability. These principles include several main components to ensure that the document is safe, original, verified, and accessible as needed. Ensuring the reliability of documentation during electronic transactions indicates that the electronic system used for such transactions is trustworthy and well-managed in terms of security.

2.png

Figure 2. Proposed framework for document security reliability audits (DRSA)

Table 1. DRSA framework component description

4.1 Document integrity (DI)

Document integrity is a critical component in the audit of the reliability of electronic-based government information systems, ensuring that documents do not undergo unauthorized changes during their life cycle, from creation to storage, distribution, and deletion [31]. In the context of government, document integrity refers to documents remaining original, intact, and unaltered since their initial creation. This is essential because damaged or altered documents can lead to errors in decision-making, legal violations, or loss of public trust.

To maintain document integrity, various supporting technologies are employed, including encryption, checksums (a method of checking a file’s integrity through a hash or code generated from its contents), and digital signatures. Digital signatures ensure that documents cannot be changed after they are signed because any alteration will modify the hash or document identification code, making it immediately detectable. During the audit process, auditors check whether important documents have used digital signatures or other security marks to ensure integrity. This involves technically checking the document hash and comparing it with the initial hash generated when it was first created or authorized. Any discrepancies indicate the possibility of unauthorized changes, necessitating further investigation to determine the cause. In addition, document integrity in government systems is maintained by recording every instance a document is opened, changed, or accessed, including by whom and when. These measures enable government systems to maintain the reliability of information and ensure that documents used in decision-making remain accurate and unaltered by unauthorized changes.

Table 2 presents the audit working paper draft for checking document integrity.

Table 2. Audit working paper for document integrity check

4.2 Authentication of validity (AV)

The authentication validation audit process for electronic- based government information systems aim to ensure that authentication methods, such as passwords and two-factor authentication (2FA), are implemented with adequate security standards. The auditor examines the various authentication methods, including verifying password management policies (e.g., length, complexity, and frequency of password changes) and ensuring additional authentication, such as 2FA, for users with sensitive access. If the system uses biometric authentication or single sign-on (SSO), the auditor will also evaluate the security of the configuration of these methods.

Table 3 presents an example of an audit working paper for authentication validation.

Table 3. Audit working paper for authentication validation

4.3 Audit trail

An audit trail is a record that tracks all user activities within a system, including access, changes, or deletion of data. In electronic government information systems, audit trails are essential for maintaining security, data integrity, and compliance with audit standards. The primary function of an audit trail is to document all user actions, enabling auditors to assess whether the system has been used in accordance with applicable policies and procedures. Audit trails help detect suspicious activity or security breaches by recording important information, such as user identity, access time, actions taken, and data changed. Table 4 presents an example of an audit trail worksheet.

Table 4. Audit working paper for audit trail

4.4 Document lifecycle management (DLM)

DLM is the process of managing documents throughout their life cycle, from creation to destruction. In electronic government information systems, DLM ensures that documents are managed in accordance with applicable security, integrity, and compliance standards. This management includes control over access, storage, distribution, and destruction of documents efficiently and securely. Audits of DLM aim to ensure that documents are stored, updated, and deleted according to established procedures, maintaining data integrity and accuracy throughout the document life cycle. Table 5 presents an example of DLM audit working paper used in an electronic government system audit.

Table 5. Audit working paper for document lifecycle management

4.5 Access control

Access control limits and regulates access to data or resources in a system based on user authorization. In an electronic-based government information system, access control aims to protect critical data and resources from unauthorized access or misuse. Through access control, organizations can determine who is allowed to view, edit, delete, or create specific data within the system. The goal of access control in auditing is to ensure that access rights are granted only to authorized users, aligned with their job requirements, and to minimize security risks that may arise from unauthorized access. Table 6 presents an example of audit working paper for access control.

Table 6. Audit working paper for access control

4.6 Regulations and compliance standards

Organizations must adhere to regulations and compliance standards to ensure that their operations and information systems meet legal, ethical, and security requirements. In the context of governments or large organizations, compliance with relevant standards and regulations is critical to maintaining transparency, data security, and efficient operations. These regulations may include government regulations or international standards designed to ensure the security, privacy, accessibility, and integrity of systems. Examples of commonly applied rules in government information systems include the General Data Protection Regulation (GDPR), ISO/IEC 27001 on information security management, and other local standards applicable in specific regions or countries.

The audit of regulations and compliance standards aims to ensure that the information system meets all applicable requirements.

This audit assesses compliance with each provision set, including privacy policies, data security, and data management practices in accordance with standards. Table 7 presents an example of audit working paper for regulations and compliance standards.

Table 7. Audit working paper for regulations and compliance standards

4.7 Document availability and accessibility

In auditing the reliability of electronic-based government information systems, document availability and accessibility are essential aspects that must be evaluated to ensure that the information system manages documents effectively and that they can be accessed according to applicable needs and regulations. The reliability of the information system includes its ability to provide the required documents at any time without disruption, as well as ensuring that only authorized parties can access the records. Table 8 presents an example of an audit working paper for document availability and accessibility.

Table 8. Audit working paper for document availability and accessibility

4.8 Document versioning and control

Document versioning and control in information systems refers to managing changes occurring throughout a document's life cycle. This is essential to maintaining the integrity and transparency of the document, ensuring that any changes are recorded, and providing the ability to track, recover, or compare different document versions. Document versioning refers to assigning a version number or specific identifier to each revision or change made to a document. Table 9 presents an example of an audit working paper for document versioning and control.

Table 9. Audit working paper for document versioning and control

4.9 Disaster recovery and data sustainability

Disaster recovery refers to the policies and procedures designed to recover data and systems disrupted by disasters or system failures. This includes any threat that could disrupt operations, such as natural disasters, cyberattacks, or technical failures. The primary goal of disaster recovery is to ensure that data and systems can be restored as quickly as possible, minimizing downtime and reducing the impact on public services. A robust recovery policy should include a regular data backup strategy, systematic recovery testing, and efficient and well-planned system recovery processes.

Meanwhile, data sustainability focuses on an organization's ability to ensure that data remain secure, available, and accessible without interruption, even during emergencies or disasters. This involves data management that prioritizes both short-term protection and long-term data management, ensuring that data remain usable and accessible to authorized parties. Data sustainability includes secure storage policies, data backup management, and the continuation of effective data use despite technical disruptions. Table 10 presents an example of an audit working paper for disaster recovery and data sustainability.

Table 10. Audit working paper for disaster recovery and data sustainability

4.10 Trustmark implementation

Implementing Trustmark in electronic-based government information systems assures that the system meets specific standards for security, reliability, document validity, and regulatory compliance. Trustmark functions not only as a quality indicator but also as a tool that integrates various elements in the document reliability audit framework, from authentication and data recovery to document management. With Trustmark, government systems can better manage essential documents and data, providing the security and transparency needed to support excellent and accountable governance. The Trustmark labeling mechanism is based on the assessment standards that have been conducted.

The final evaluation results are calculated using the following formula:

Total Final Score = $\sum$ Weighted Score of Each Component         (1)

Table 11 presents an example of an audit evaluation summary of the reliability of transaction document security.

Based on Table 11, the subsequent step is to provide a reliability rating based on Trustmark using the provisions outlined in Table 12.

Table 11. Example of audit evaluation summary of transaction document security reliability

Table 12. Trustmark categories

Based on the findings, along with audit examples for each component, there are significant implications for the e- government system in Indonesia, especially in improving the reliability of the electronic-based government information system (EBGS). The practical application of the DRSA framework can ensure that documents and data within the government system are well managed, their integrity is guaranteed, and they are protected from unauthorized access. For example, implementing technologies such as digital signatures and encryption will prevent unauthorized changes to documents, ensuring that the information used for decision- making remains accurate and reliable. In addition, employing strong authentication such as two-factor authentication (2FA) and role-based access control (RBAC) will ensure that only authorized parties can access or modify sensitive data. A complete audit trail is also crucial, as it records every activity within the system, enabling the detection and swift resolution of any violations or suspicious activities. Furthermore, effective document lifecycle management (DLM) ensures that documents are managed from creation to destruction in accordance with applicable policies, maintaining data security and integrity throughout their lifecycle. Compliance with international standards, such as ISO 27001, will also enhance transparency and ensure that e-government systems comply with applicable regulations.

My deepest gratitude goes to Prof. Purwanto, my dissertation promoter, who guided me in compiling a comprehensive concept and direction. I am equally grateful to my copromoter, who provided detailed guidance on critical issues that I had not understood. I would also like to thank my colleagues at the institution and my college friends for their openness in sharing knowledge, which greatly helped me in compiling this paper as part of my dissertation.