This paper describes an integrated web security system (IWSS), which can be used as a security management tool for a web-based information system (WBIS). IWSS is intended to address the security issues common to most of web systems and supplement to the current risk analysis tools. It provides an integrated security environment based on risk analysis and assessment. It can increase the system security and prevent unauthorized external access to an enterprise network.