摘要
智慧型手機功能豐富、使用方便，能讓使用者輕易獲得所需資訊，因此各種行動商務的應用應運而生，行動銀行是其中之一。消費者可透過行動銀行系統進行轉帳、買賣基金及獲得金融與生活資訊，其方便性受到消費者的期待，但因它係以智慧型手機透過無線電信網路暨網際網路與銀行之伺服主機相連接，致衍生安全性相關問題。行動銀行系統暴露在網際網路及無線電信網路的環境裡，除了會受到駭客入侵、木馬程式、阻斷服務或病毒的攻擊，也是病毒、木馬程式等威脅的散播管道，容易遭有心人士入侵系統主機竊取機密資料、篡改文件與破壞系統。因此，如何確保行動銀行交易安全，乃為一項重要議題。本研究為提昇行動銀行交易安全及系統資訊安全風險控管之水準，透過國際標準ISO/IEC27001:2005，來評估行動銀行系統之安全性，並對個人資料保護，以及委外和內部控制措施，提供建議及補償性控制措施（compensating controls）。本研究建議定期對行動銀行系統客戶進行滿意度調查，俾利從中發現問題並採取必要控制措施，以促使行動銀行系統之資通安全更臻於嚴密。本研究主要提供三點結論：（一）智慧型手機行動銀行系統的威脅主要來自內部的人為事件，應以資訊安全標準所建議之控制措施，確實做適當的控制；（二）對行動銀行系統資訊資產風險等級較高者，如消費者行動銀行系統之帳號、密碼，行動銀行應用系統及主機管理人員等應優先實施控制措施，以利將行動銀行系統的風險降至較低水準；（三）對行動銀行系統之帳號、密碼修改、異地／同地備援及權限管理等控制措施不足之處，應以ISO/IEC27001:2005建議之控制措施管理，讓消費者可以在安全的環境下，使用方便的金融服務。金融業可根據上述結論，對其行動銀行建立安全性檢核機制，以提升行動銀行的滿意度。
並列摘要
The smart phone is one of the most popular products because it's feature-rich and easy to use. Because its features so that users can easily obtain the needed information, and the application of a variety of mobile commerce came into being, mobile banking is one of them. Consumers can transfer money, trading funds through the mobile banking system and access to financial information and living information. The smart phone's convenience is expecteds by consumers, but it connects to the bank host through wireless telecommunications network and internet, resulting in security-related issues. Mobile banking system is exposed to the environment of the Internet and wireless telecommunications network. Customers had to be aware that these systems could be subject to attacks by hackers, Trojan horses, denial of service programs or virus, and also made viruses, Trojans and other threats to the spread of the pipeline. It is also vulnerable to the theft of confidential information tampering with files and damage of systems by interested parties. How to ensure the security of mobile banking transactions has gradually become an important issue. This study is to improve the mobile banking transaction security and information security risk management level to assess mobile banking system security through the international-standards ISO/IEC27001:2005, and to provide advice and compensating control measures for the protection of personal data, as well as outsourcing and internal control. The study recommends the implementation of regular customer satisfaction surveys, which will help to find the related problems and to take the necessary control measures, and enhance the information and communication security of the mobile banking. This study's main findings are as follows. (1) the threat of the smart phone mobile banking system is mainly from the personnels inside the organization. Information security standards proposed control measures can be used to ensure the appropriate controls. (2) The most important mobile banking's information assets, such as consumer's ID and password, mobile banking systems, and host management. The bank should take much control for those assets to lower the risk. (3) The insufficient of important information asset control for the mobile banking system, such as off-site / local backup system, mobile banking ID / password management, the permissions of the host management, and log server management, should be based on the ISO 27001 proposed control measures. As a result consumers can be in a safe, easy to use financial services environment.
參考文獻
延伸閱讀
- 曹明玉（2006）。資訊安全認知評量表之研究〔碩士論文，淡江大學〕。華藝線上圖書館。https://doi.org/10.6846/TKU.2006.00417
- 劉志銘（2005）。資訊安全情境認知模式之研究〔碩士論文，淡江大學〕。華藝線上圖書館。https://doi.org/10.6846/TKU.2005.00018
- 陳秀琳（2006）。銀行業資訊科技與資訊策略之關係研究-個案銀行探討〔碩士論文，國立臺灣大學〕。華藝線上圖書館。https://doi.org/10.6342/NTU.2006.00887
- 吳振昀（2007）。金融服務業導入資訊安全管理機制影響之研究〔碩士論文，國立臺北科技大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0006-0908200716454100
- Tung, T. Y. (2014). 行動資料安全管理之設計原則與實作 [doctoral dissertation, National Taiwan University]. Airiti Library. https://doi.org/10.6342/NTU.2014.02268