資訊安全法制趨勢研析– 論建立國家層級資通訊安全標準與認驗證制度

由於資訊科技快速發展，國家社會制度與人民生活型態皆隨之產生變化。隨著網際網路的普及，政府資訊系統及網路服務業者提供之網路服務也快速增加，民眾的日常已經難以離開網路資訊系統，如網路資訊系統遭駭客惡意破壞、癱瘓而無法正常運作，或因此導致個人資料外洩，將對民眾與社會產生巨大的影響。為了因應時局的改變，各國政府開始研提各種資訊安全法律制度，以促進資安發展，並加強對資訊資產的保護。本文將探討對世界有較大影響力的美國、日本、中國及歐盟在資訊安全法制上的發展，以了解資訊安全法制在世界上之發展趨勢。在資訊安全領域中，本文認為資訊安全標準與認驗證制度為其中最重要之基石，因此，除了探討美國、日本、中國及歐盟之資訊安全法制基本架構外，更將深入了解其於資訊安全標準與認驗證制度上之發展與規畫。綜合上述各國在資訊安全法制之規劃，多是成立國家層級專責監管機關，訂定資訊安全管理專法，要求政府機關與關鍵基礎設施業者應做好資訊系統之資安風險分級與資安防護計畫、評估與改善、緊急通報與分享、資安事件演練等。而在資訊安全標準與認驗證制度上，則多透過法律授權成立國家層級之專責機構，負責訂定資安標準並執行相關認驗證。我國蔡英文總統於2016年8月在國安會提出「資安就是國安」政策，並於2018年6月通過「資通安全管理法」專法，我國開始進入資訊安全專法時代。然而比較我國與他國之資訊安全標準與認驗證制度，我國在資通安全管理法中，並未以法律授權成立國家層級之資訊安全標準機關，資通訊產品安全標準仍維持由各目的事業主管機構各自負責，導致我國資通訊相關產品及服務之資安標準與認驗證制度，缺少一個整體的框架，而無法制定出更全面的制度規畫。本文嘗試透過探討美國、日本、中國及歐盟在資訊安全法制上之發展，反思我國現行制度上之不足，並建議應設立國家層級之資訊安全與認證標準專責機構，以完善我國資訊安全標準與認驗證制度，並以此為基礎，強化我國資訊安全法制之發展。

關鍵字

資訊安全；信息安全；資訊安全認證；信息安全認證；資訊安全評估；網路安全；網絡安全

並列摘要

Due to the rapid development of information technology, the society and people’s lifestyles have changed. With the popularization of the internet, there are more and more internet services provided by government and internet service providers. It is difficult for people to go without the internet in their daily life. It will be a huge impact if the internet is damaged by hackers and cannot operate normally, or the personal information is exposed in a data breach. In response to changes in this situation, many countries start to establish a legal framework for information security. Their purposes is not only to promote the development of information security, but also to protect the information assets. This thesis will discuss the development of information security legal framework in the United States, Japan, China, and the European Union, which have a greater influence on the world, to understand the trend of information security legal framework in the world. For the opinion of this thesis, information security standards and its certification systems are the most important parts in the field of information security. Therefore, in addition to the basic information legal framework, it will discuss the development and the plans of information security standards and certification systems in the United States, Japan, China, and the European Union. Most countries choose to establish national-level dedicated supervisory agencies and formulate special laws on information security management in their information security legal framework. Moreover, they require that government agencies and critical infrastructure companies should confirm the risk classification, protection plans, assessment, improvement, emergency notification and incident drills of their information security systems. As for their information security standards and its certification systems, most countries choose to establish a national-level specialized agency which is authorized by law. The agency will responsible for set standards and implement related certification and verification. In August 2016, our President Tsai Ing-wen put forward the “Cyber Security is National Security” policy at the National Security Council. After that, The Cyber Security Management Act was passed in June 2018. It shows that we have entered an era of Cyber Security. However, comparing our information security standards and its certification systems with other countries, instead of establishing a national-level specialized agency, our security standards are in charge of diffrerent agencies according to different types. Owing to the decentralized management, our information security standards and its certification systems lack an overall framework and a comprehensive plan. The thesis aims to reflect on our shortcomings through discussing the development of information security legal framework in the United States, Japan, China, and the European Union. Also, the thesis suggests that we should establish a national-level specialized agency to promote the development of our information security legal framework.

並列關鍵字

Information security ； Cybersecurity ； Network security ； Information security Certification ； Information security evaluation ； Information security Accreditation