AN INFORMATION SYSTEM SECURITY EVALUATION METHOD OF BUSINESS OPERATION TARGETING THE SERVICE COMPOSITION