- 學位論文
系統日誌收集與事件分析及產出為遵循ISO27001報表之應用系統設計與實作
Design and Implementation of An Application System for Event Log Collection with Incident Analysis and Reports conforming to ISO27001
摘要
ISO/IEC 27001 國際標準在資訊安全管理方面，有著嚴謹的控制，並依循著規劃(Plan)、執行(Do)、檢查(Check)、行動(Action)即PDCA的精神，持續改善。在此管理系統下，一般的做法是組織依據人的專業來進行管理；然而管理的過程恐涉及人為因素或第二手處理，導致在控制上會有偏差或疏漏，進而使得在其管理系統中的控制的遵循性及有效性會被質疑。 本論文使用獨立的系統，以Oracle資料庫、PL/SQL程式語言及JSP語法實作，將所收集的設備所產生的日誌(Log)，轉存入資料庫以利後續處理，並保存相關資訊。過濾掉正常訊息後，針對有異常的日誌進行辨別，並依據組織的特性、政策、相關法令及過往經驗，設定特徵以識別事件。進而分析以有效反應組織現況，回饋到組織的風險評鑑。接著組織管理階層可進行有效地審查風險評鑑，資產負責人也可有效率地找出根因以矯正預防，以降低組織的資訊安全危害。
並列摘要
ISO/IEC 27001 provides substantial controls in information security management (ISMS) and applies Plan-Do-Check-Act model, PDCA, to improve the ISMS continuously. In ISMS, generally, organizations are managed by individuals with their professions. However, such this management scheme may cause bias and incompleteness in controls because of human nature and second-hand manipulation. Furthermore, the conformity and the effectiveness of controls in the ISMS will be on suspicion. In this study, we develop a standalone system, derived from Oracle database, PL/SQL, and JSP, to collect logs which are from specified equipments and to insert those into the database for further processing. After filtering normal messages, the system recognizes the remains and identifies incidences based on the factors from the organization’s features, policies, regulations concerned, and experiences. Ultimately, the analyses of the incidences can reflect the organization’s conditions reliably and feed back to its own risk assessment (RA). Then, the management can review RA effectively and the owners of the assets in the organization are able to efficiently find the real root cause so as to correct and to prevent the incident. Consequently, the damage of the information security in the organization will be reduced.
參考文獻
延伸閱讀
- 魏銪志、洪韻茹、陳昇智、祝亞琪（2020）。隱私資訊管理系統標準ISO27701於GDPR適用性評估。電腦稽核，(42)，40-51。https://www.airitilibrary.com/Article/Detail?DocID=2073090X-202008-202009230014-202009230014-40-51
- 李宜樺、張瑞婷、陳靖宜（2022）。現行永續報告編製及ISSB草案之比較－金融業、科技通訊及資源轉化業之因應。會計研究月刊，(443)，93-97。https://doi.org/10.6650/ARM.202210_(443).0013
- 張慧芳、林怡君（2019）。建構護理交班資訊系統對工作績效影響之模式。醫療資訊雜誌，28(1)，9-20+22。https://www.airitilibrary.com/Article/Detail?DocID=10213155-201903-201905210012-201905210012-9-20+22
- Lee, H. Y. (2012). Integrated intelligent management platform for the built environment incorporating agent-based simulation and geographic informationsystem [doctoral dissertation, The University of Hong Kong]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0029-0611201300011858
- 陳啓光、廖世凱、蔡政和、謝安晉（2008）。An Exploratory Study of the Effects of Process Management for Implementing ISO 9000 Quality System-Using Product Yield as Performance Indicator。品質學報，15(1)，85-100。https://www.airitilibrary.com/Article/Detail?DocID=10220690-200802-15-1-85-100-a