風險限制與成本考量下之資安控制措施決策方法

A Decision Method to Select Information Security Controls ─ Considering Risk Condition and Cost

辛婉甄(Wan-Chen Hsin)

指導教授 ： 徐煥智

淡江大學/管理學院/資訊管理學系碩士班/碩士(2007年)

https://doi.org/10.6846/TKU.2007.00042

摘要

隨著資訊安全管理觀念的逐漸受到重視，資訊安全風險評鑑已成為推動資安管理的初步重要工作。如何最有效益的利用資源來進行資安控制措施的建置以達到企業組織存在於一個可承受的資安風險損失水準環境，在策略決策上是一個重要的議題，但相關研究卻較為缺乏，因此本研究藉由探討風險分析管理等相關文獻，將量化風險分析的觀念導入資訊安全策略決策中，提出一套資安控制措施規畫決策模式，利用Uryasev(2000)提出的條件風險概念，應用於資安策略決策模式的建構上，使用此方法使企業在做損失評估時，能有更明確的決策選擇，以減少企業的損失，協助各企業在資訊安全管理中做適當的管理決策。在未來希望可以把此模式應用在現實的企業資安控制措施規畫決策過程中，增加該模式的可行性。

關鍵字

資安控制措施 ； 風險值 ； 條件風險值 ； 資訊安全管理

並列摘要

Information security management has become an important issue in many various organizations. The fundamental work for information security management is how to assess the security risk and implement the information security controls to reach an acceptable information security level. However, only few related researches have been done so far. In this thesis, we apply the concept of conditional value of risk proposed by Uryasev (2000) to create a quantitative decision model for the selection of information security controls. In the decision process, the acceptable risk and security cost are considered. Using the model, the decision makers can make a more appropriate decision to minimize their information security cost according to the risk or loss they can bear. Our case study demonstrates the proposed model with the potential of becoming very useful in practice and of leading to further generalization of information security decision analysis.

並列關鍵字

Information Security Control ； VaR ； CVaR ； Information Security Management

參考文獻

[8]BS7799/ISO27001 Auditor/Lead Auditor Training Course

[7]Basak, S., and Shapiro, A., “Value-at-Risk Based Risk Management: Optimal Policies and Asset Prices,” Review of Financial Studies, pp371-405, 2001.

[9]Simon, H. A., “Administrative Behavior-A Study of Decision-Making Processes in Administrative Organization,” 1997.

[11]Jorion, P., “Philippe Jorion’s Orange County Case: Using Value at Risk to Control Financial Risk,” http://www.gsm.uci.edu/~jorion/oc/part1, 2001.

[12]Hong, K. S., Chi, Y. P., Chao, L. R., and Tang, J. H., “An Integrated System Theory of Information Security Management,” Information Management & Computer Security, pp243-248, 2003.