AHP應用於國軍資訊安全之研究

Using Analytical Hierarchy Process in the military information security research

尤翰彬(Han Pin YU)

指導教授 ： 龐金宗

元智大學/資訊學院/資訊管理學系/碩士(2009年)

摘要

隨著時代科技發展，駭客入侵或病毒感染，造成個人資料遭竊取、智慧財產被侵犯、重大設施遭破壞、金融機構被入侵和國家機密資料遭滲透，均顯現資訊安全工作越顯重要，而資訊安全防護工具及安全防護的機制是較欠缺的環節。在過去的研究學者多從技術性角度確保資訊安全的應用，較少學者探討從管理角度應用於資訊安全。
所以，本研究運用層級分析法(AHP)探討組織資訊安全決策方式，在「電子業」、「醫療業」及「國軍單位」等組織中分析其重要考量之關鍵因素，並利用ISO 27001的11大項控制要項、39項控制目標、133項管制措施建立層級結構，層級架構中第二層架構區分為「管理面」、「人員面」及「設備面」構成，第三層架構以ISO 27001之11項控制要項構成，最後，再利用資訊安全決策方案劃分「視情況委外」、「委外」、「自製」及「消除及轉移」等4項選擇方案，依照各組織不同的特性，選擇出最適之資訊安全評估決策方案與建議，並探討不同組織對資訊安全決策方案選擇之差異，置重點於探討國軍資訊安全選擇方案之研究，期望研究結果將來作為國軍資訊安全決策方案選擇之重要參考。

關鍵字

資訊安全、層級分析法、資訊安全管理、ISO 27001

並列摘要

With the era of technological development, hackers or virus infection, caused by the theft of personal data, intellectual property infringement, the destruction of major facilities, financial institutions and the country was invaded by the infiltration of confidential information, are showing the work of information security more important, and information security tools and mechanisms for security is more the lack of link. In the past researchers from the technical point of view to ensure that the application of information security, and less from a management point of scholars explore the application of information security.
Therefore, this study was the use of Analytical Hierarchy Process (AHP) to explore information security decision-making in the "electronics industry", "medical profession" and "national troops unit" organizations, and using the ISO 27001 11 major term control important item, 39 control objectives, 133 control measure to establish the level structure. The second level of it includes "the management surface ", "the staff surface" and "the equipment surface", and the third construction by ISO 27001 11 control item. Finally, re-use information security decision-making program to divide four options: "as the case of outsourcing", "outsourcing", "Home", and "the elimination and transfer ", in accordance with the characteristics of the different organizations , select the most suitable decision-making information security assessment programs and proposals, and to explore the different organizations on information security decision-making differences between options, and placing the focus on information security to discuss the military options of study. Moreover, expectations of future results can provide the military decision-making information security program important reference choice.

並列關鍵字

Information Security、Analytical Hierarchy Process、Information Security Management、ISO 2700

參考文獻

[4] 辛宜聰，「國軍主計機構知識管理關鍵成功因素評估模之研究-Fuzzy AHP之應用」，元智大學，碩士論文，民國九十七年。

[15] Avizienis, A. et al., Basic Concepts and Taxonomy of Dependable and Secure Computing, IEEE Transactions on Dependable and Secure Computing, IEEE ,Vol.1, No.1, pp.11~33, 2004.

[16] BSI (2005), “Information security management-- Part 1: Code ofpractice for information security management＂, BS 7799-1:2005, BSI.

[18] Belton ,V . and A.E. Gear (), The Legitimacy of Rank Reversal-A Comment, Omega, 13(3),227-230. 1985.

[22] McDaniel, George, ed. IBM Dictionary of Computing. New York, NY: McGraw-Hill, Inc., 1994.