資通安全體系發展策略之研究

Information and Communication Security Mechanism Development Strategy

陳如芬(Ru-fen Rhonda Chen)

指導教授 ： 曹承礎

共同指導教授 ： 柯承恩

國立臺灣大學/管理學院/資訊管理組/碩士(2009年)

https://doi.org/10.6342/NTU.2009.10169

摘要

資通訊科技在現代高度競爭的產業環境中，扮演著關鍵性的角色，網路整備度儼然成為國家競爭力的指標。然而資安威脅近年來急速成長，由早期以炫耀技術為主的獨立駭客行為，經典範移轉成以經濟或政治為目的之有組織、有計畫的作業。Michael E. Porter於1990年提出分析國家競爭優勢的鑽石理論架構，披露了優勢產業之競爭力與其所屬國家的關係，並歸納出國家環境是競爭力的關鍵。如何強化資通安全，並建構完備的整體資安發展體系，是對不論已開發或開發中國家，欲提升其國際競爭力之一項極為重要且刻不容緩的議題。

資通安全與資通訊科技息息相關，而資通訊與資安科技發展進程與整個人類科技發展史比較，相對年輕，且仍在不斷的演進中，故在此領域並無太多先行者的範例可供模仿。故本研究收集臺灣資安領域專家意見及匯整相關次級資料，回溯我國從無到有建置資通訊基礎環境資安機制的發展歷程，並融合Porter國家競爭優勢鑽石模型的分析，嘗試提出未來建構整體資安體系的發展策略。

本研究認為，完善的整體資安體系發展策略應涵蓋創造需求的『環境面』與『應用服務面』，以及供應端的『產業發展面』，而臺灣具備特殊的生產要素條件，可積極培育資安人才、掌握關鍵資安技術，推動資安相關產業成長茁壯。

關鍵字

資通安全 ； 網際安全 ； 網路安全 ； 資安治理 ； 資安管理系統

並列摘要

Information and communication technology plays a critical role in modern highly competitive industrial environment, ICT-enabled network readiness has become a major indicator to demonstrate the competitive advantage of nations. Yet malicious activity and security threat based on ICT continues to grow at a record speed. The attack technique and mentality has gone through paradigm shift from pure show-off to political economic objective. Michael E. Porter proposed the Diamond Model to analyze the Competitive Advantage of Nations in 1990, which pointed out that the predominant advantages created by certain competitiveness resulted from some phenomena or environmental factors of nations. Therefore, as developed and developing countries aim to promote their national competitiveness via establishing ICT infrastructure, the importance of information security continues to emerge.

Security is deeply coupled with information and communication technology. The emergence and development of both security and information communication technologies is relatively adolescent compared to the entire human science and technology progression history, and they are still evolving. Therefore, there are rarely any success patterns to follow. This research interviewed domain experts and collected secondary data, to reconstruct the past development of Taiwan information security mechanism. This research then absorbed Porter’s Diamond Model analysis, tries to propose future information security mechanism development strategy for Taiwan.

This research concludes that a mature and holistic security mechanism development strategy shall include three aspects: environmental constitution, application and service, as well as industrial development. The first two aspects may create demands, while the third involves the supply side. Taiwan’s geographical and political situations brought specific factor conditions, which enable Taiwan to pro-actively cultivate talents in security domain, seize related technology development trend and business opportunity, so as to promote the security industry for prosperity.

並列關鍵字

Information Security ； Cyber Security ； Network Security ； Information Security Management System ； Information Security Governance

參考文獻

24. US Fiscal Year 2008 Report to Congress on Implementation of The Federal Information Security Management Act of 2002

2. 波特著，李明軒、邱如美合譯，國家競爭優勢，（Michael E. Porter, The Competitive Advantage of Nations），台北：天下遠見出版，1998年

18. Shaun Posthumus and Rossouw von Solms, A framework for the governance of information security, Computers and Security, 2004。

20. CSI/FBI Computer Crime and Security Survey”, FBI, 2008

25. The Annual Cisco Security Report, 2008