美國關鍵基礎設施防護法案與資訊安全管理技術控制標準化

Study on U.S. Critical Infrastructure Protection Act and Standardization of Technical Control in Information Security

樊國楨(Kwo-Jean Farn) ； 韓宜蓁(I-Chen Han)

《國防雜誌》 30卷4期 (2015/07) Pp. 97-122

https://doi.org/10.6326/NDJ.2015.30(4).5

摘要

關鍵基礎設施是國家為維持民生、經濟與政府運作而提供之人民日常生活的基本功能及服務；基礎設施的運轉中斷，將對公共服務、民眾生活以及國家安全導致危害。2013年3月韓國遭受摧毀磁碟開機主引導記錄（Master Boot Record, MBR）之攻擊，致使銀行金融網、廣播電視網及保險公司，共超過48,000部伺服機、電腦以及提款機無法啟動的資訊安全事故，留下「初戰即是終戰，首戰就是決戰」之關鍵資訊基礎設施防護（Critical Information Infrastructure Protection, CIIP）網路攻防情境的印記。鑑於關鍵基礎設施網路安全之重要性，CIIP的政策、標準與法規，已成為先進國家長策大政的議題，我國亦研議「關鍵基礎設施防護法案」中；參卓美國自1998年第63號總統決策令（PDD－63），至2013年歐巴馬總統之第21號總統政策令（PPD－21）的CIIP之標準化與法制化的整備歷程，本文綜整美國CIIP之演進及其關於資訊分享、個人資料保護框架與國際標準組織之標準化進程，再對於我國之情境加以探討，並提出本文之觀察及建議。

關鍵字

關鍵資訊基礎設施防護 ； 資訊分享 ； 個人資料保護法 ； 法規化 ； 標準化

並列摘要

Critical infrastructure is the basic functions and services provided by country for people's daily life so that people's livelihood, economy and government operations can be maintained. These infrastructures such as communications, finance, electricity, water, and medical services are indispensable. If the operations of these infrastructures are disrupted, it will cause damage to public services, people's life, and national security. The attack on Master Boot Record (MBR) on March 20, 2013 in Korea resulted in the breach of information security which caused the failure of a total of over 48,000 servo machines, computers and cash machines of financial networks and paralyzation of three broadcast networks. This cyber incident has raised the question of ＂the initial war is the final war; the first battle is the decisive battle.＂ The issues of attack and defense of networks and Critical Information Infrastructure Protection (CIIP), therefore, have been seriously addressed and discussed. In view of the importance of cybersecurity for critical infrastructure, the policy, standards, and regulations of CIIP have become major political issues in advanced countries. Likewise, in Taiwan, the Critical Infrastructure Protection Act has also been researched. The whole preparation course of standardization and legalization of CIIP from PDD-63 on May 22, 1998 to President Barack Obama's PPD-21 on February 12, 2013 in the United States is a good reference. Based on this reference, the entire evolution of American CIIP, and the processes of its ISO standardization on comprehensive framework of information sharing and protection of personal data was complied. Based on Taiwan's national situation, this study conducts investigation and observation and proposes policy recommendations.

並列關鍵字

Critical Information Infrastructure Protection ； Information Sharing ； Personal Data Protection ； Regulation ； Standardization