This paper mainly discusses the security analysis in web-based information systems. The analysis focuses on current client/server system application environment and system vulnerabilities. The paper also briefly describes a proposed conceptual security model — dual security model (DSM). The model focus on risk management by identifying possible attacks to the system and address them before they can impact significantly the system security and the business of the organisation. The key design feature of this model is to develop a high level risk assessment framework for analysing and evaluating the system environment, interrelated system functions, risk modelling and evaluation process in web-based information systems.