資訊安全風險評估模式之研究―以某半導體封裝公司為例（下）

胡瑞賢

《電腦稽核》 22期 (2010/07) Pp. 1-22

https://doi.org/10.30007/JICTA.201007.0001

摘要

近年來資訊安全事件時有所聞，對企業營運所造成的損失日益嚴重，由於企業內部作業環境已逐漸資訊化與電子化，致使企業產生新的營運風險，故而對於資訊安全如何有一套有效的管理架構的需求便日益迫切。
本研究採用國際標準ISO27001作為資訊安全管理架構的基礎，研究範圍為資訊安全管理架構之主要程序―「風險評估」在此程序將整個資訊安全風險評估模式分成資訊資產識別盤點與分類、資訊資產價值評鑑、資訊資產弱點評鑑、資訊資產威脅評鑑和資訊安全風險評鑑五個階段，並參考相關文獻以及透過相關領域專家的訪談，定義出適用於個案公司且可評量的資訊安全風險評估的操作性定義跟步驟，並擇某封裝測試公司之某一企業關鍵資訊系統為例說明此套方法。最後，透過資訊安全顧問公司的專家來進行驗證，以驗證此模式之可用性，並以所獲得此模式實行之結果來作為後續改善的基礎。
本研究結論希望能提供一個適合個案公司且實際可行之資訊安全風險評量模式，以作為該個案公司之內部稽核人員與管理階層評量資訊安全風險與制訂風險回應計劃之參考。

關鍵字

資訊安全 ； 風險評估 ； 資產評價 ； 資產弱點 ； 資產威脅

並列摘要

The information security incidents have most often been reported. The loss of enterprise operation is more and more serious because of information security incidents. There are more and more operation risks happening inside the enterprise because of such informational and electronic transformation. Consequently, the requirement to have an effective management framework of information security is more and more urgent.
The research adopts the international standard ISO 27001 as the foundation of the information security management framework. And then, risk assessment is the main process of the informational security management framework. This process includes five stages: assets, value evaluation of information assets, vulnerability assessment of information assets, threats assessment of information assets, and measurement of information security risks. The operational definition, implementation steps and measurement of the information security risks are worked out through review of relevant literature and interview with experts in the semiconductor assembly company. Finally, the experts of the consulting firm of the informational security are entrusted to verify the availability of the model. The result of this informational security risk assessment model will be used as the basis for future improvement.
It is hoped that this research can offer a guideline for the information security risk assessment suitable for the semiconductor company and can be used as a reference for internal auditors and management.

並列關鍵字

Information Security ； Risk Assessment ； Assets Evaluation ； Assets Vulnerability ； Assets Threats