半導體製造產業資訊安全知識管理之探討—以P公司為例

A Research of Information Security Knowledge Management in Semiconductor Manufacturing Industry - Company P for Example

張雲祥(YUN-HSIANG CHANG)

指導教授 ： 黃天佑

中原大學/商學院/資訊管理研究所/碩士(2007年)

https://doi.org/10.6840/cycu200700344

摘要

在當前全球競爭的形勢中，企業紛紛運用資訊技術來提升公司的競爭優勢，加強資訊科技的相關建設，並加速與國際間的同步發展。而企業也因資訊蓬勃發展、IC體積縮小及功能增進，讓許多原本笨重的設備漸漸地縮小，使得眾多嶄新的產品因而誕生增加企業產品競爭力。

　　但是資訊化同時也帶來了駭客攻擊或網路犯罪行動，企業商業機密面臨到被竊取的可能，研發技術資料和金融財務等重要系統暴露在可能被破壞或入侵的危險之下，最嚴重的情形更足以威脅到企業體系的生存和競爭優勢。因此建構企業的資訊安全防護，以及制定企業內部相關安全機制更是刻不容緩。

本論文以資訊安全管理為出發點，透過知識管理，將半導體製造產業所擁有的設計開發知識，用資訊安全機制控管。本研究目的將探討半導體製造產業資訊安全，有哪些部門、設施系統適合做知識管理，哪些知識管理活動可以協助半導體產業資訊安全管理的提昇以及探討如何運用知識管理活動達成知識管理的功能，期望改善現時在資訊安全上掌握能力，提昇整體安全運作效率，使IT工程師能把資源真正運用在有助於提昇公司競爭力、降低公司研發成本，增進公司產品品質。

文獻部分先對於「資料、資訊、知識」以層次的觀念做了明確的定義，進而了解知識的分類包括隱性知識、顯性知識、個人知識、組織知識以及之間的轉換模式，接著探討知識管理定義、知識管理活動及知識管理流程，進而產生理論性架構。

研究方法除了上述訂定研究目的、文獻探討，產生理論性架構以外，接著與資訊部門相關主管做深度訪談，依據訪談結論建構出觀念性架構，進而設計問卷，以問卷的方式請個案公司之MIS人員、稽核主管、稽核人員及管理部主管作答，將回收問卷做分析整理取得初級資料並使用統計方法進行檢定，藉以得知個案公司對資訊安全管理控制項目的看法及認知；進而將資訊安全管理構面、知識管理活動構面及知識管理功能構面做重要程度分析及關連性研究，最後將知識管理活動構面及知識管理功能構面要項分析重要程度百分比，推導出知識管理對於半導體產業資訊安全管理的貢獻的研究結果。

本研究結果可顯示，個案公司資訊安全管理及資訊安全控管目標，同時用以了解公司在資訊安全之內部稽核之議題上，為可行的、且可補彼此間之不足；利用知識管理方法與科技整合，提供知識擷取、分類、儲存及分享的機制，希望透過知識管理的探討，能夠對於半導體製造產業資訊安全有所貢獻。

關鍵字

知識管理定義 ； 知識管理活動 ； 資訊安全

並列摘要

Nowadays business makes use of information technology to maintain its competitive advantage and reinforce information peripheral devices to keep up with the international business development. Since information technology is rising and flourishing, volume of IC is reducing and functions of IC are increasing, lots of technology devices continually become light and handy. This trend provides a large number of opportunities for business to research and develop now products. When the now products are made, the competitive advantage of business is also increasing.

However, hackers and cybercrimes come simultaneously into existence while information technology brings much of benefits for businesses. It makes a result that business confidential data like R&D techniques and financial management systems are exposed to the serious threat. This situation can even threaten the operation as well as the company advantage of business. Therefore, constructing information security systems demands immediately attention.

This thesis is focus on information security management. Via knowledge management model the thesis tries to discuss the information security management in semiconductor business. The purpose of this research is to find out that knowledge management can be applied for what kind of sectors and computer systems in a company. Moreover, the thesis also tries to find out what kind of knowledge management activities can assist semiconductor business to improve information security. Finally, the thesis discusses how management activities help business achieve successful knowledge management. Through these results of the researches IT engineers can efficiently increase the competition of company, reduce cost of R&D and raise quality of products.

The document arrangement of the thesis first defies “data, information and knowledge” gradationally. Secondly, it explains the categories of knowledge including tacit knowledge, explicit knowledge, individual knowledge, organization knowledge and also explains the transformation model among different knowledge. After these explanations, the document arrangement of the thesis defies knowledge management, knowledge management activities and knowledge management procedure.

Besides the research methods given above, an in-depth interview is also one of the important research methods within the thesis. According to the content of interview, the conceptive structure is made and the questionnaire is designed. MIS workers, audit management, audit staffs and management of the management sector in the P Company are invited to complete questionnaires. After statistically analyzing the primary source from responders’ completed questionnaire, the thoughts about information security management controlling in P Company are found out. The thesis also analyzes the importance of three dimensions including information security management, knowledge management activities and knowledge management functions. By this analysis, the ratio of importance of knowledge management activities and knowledge management functions show up. According to all of the research results above, the contribution of information security management in semiconductor business is drew out.

The research result shows that in P company information security management and information security controlling are feasible and complementary. It can make knowledge be retrieved, categorized, saved and shared by taking advantage of knowledge management methods and interdisciplines knowledge. Moreover, the idea that knowledge management can efficiently assist the information security in semiconductor business is approved.

並列關鍵字

knowledge management activities ； information security ； knowledge management definition

參考文獻

12.Steven Alter, Information Systems: A Management Perspective, The Benjamin/Cummings Publishing Company, Inc.Tom Davenport, Laurence Prusak, 1998,『Working Knowledge』, 1996.

1.Anjo Anjewierden, Guus Schreiber, Hans Akkermans, Nigel Shadbolt,Robert de Hoog, Walter Van de Velde, and Bob Wielinga, 2000, Knowledge Engineering And Management: The CommonKADS Methodology, Cambridge, MIT Press.

2.Beckman, T."A Methodology for Knowledge Management." International Association of Science and Technology for Development (IASTED) AI and Soft Computing Conference. Banff, Canada,1997.

3.Davenport T.H. and Prusak Laurnnce, Working Knowledge: How Organizations Manage What They Know, Harvard Business School Press, 1998.

11.Wiig, Karl M., Robert De Hoog, Rob Van Der Spek, 1997 , SupportingKnowledge Management: A selection of Methods and Techniques?, Expert Systems With Applications, Vol. 13, No. 1, pp.15-27, 1997.