THE IMPORTANCE OF INFORMATION SECURITY IN DIGITAL COMMERCE: CYBER RISKS AND SUPPLY CHAIN GOVERNANCE IN THE DROPSHIPPING MODEL

Abstract

The growth of electronic commerce has fostered business models strongly based on digital platforms and the intensive outsourcing of processes, among which dropshipping stands out. Although this model reduces operational costs, it intensifies the fragmentation of the digital supply chain and increases exposure to cyber risks. Considering this context, this article aims to analyze, from an Information Security perspective, the risks associated with the dropshipping model, emphasizing the responsibility of data controllers and the need for structured security governance. To this end, a qualitative, exploratory, and descriptive study was conducted, based on a single case study of the Pawzzi online store, using documentary analysis, data flow mapping, theoretical threat modeling, and comparative analysis with consolidated normative references such as the NIST Cybersecurity Framework, the NIST Cybersecurity Supply Chain Risk Management (C-SCRM), ISO/IEC 27001:2022, and Brazil’s General Data Protection Law (LGPD). The findings indicate that dropshipping significantly expands the attack surface by dispersing sensitive data across multiple operators, exposing controllers to systemic risks, particularly supply chain attacks, integration failures, and human-related vulnerabilities. This study concludes that the sustainability of dropshipping depends on the adoption of information security governance grounded in continuous risk management and distributed controls throughout the digital supply chain.