企業機密資訊文件管理機制之探討─ 以摩托羅拉公司為例

The Study of Establishing Corporate Information Security System --Motorola Taiwan Company as an Example

簡文慶(Wen-Ching Chieh)

指導教授 ： 耿筠

中原大學/商學院/企業管理研究所/碩士(2001年)

https://doi.org/10.6840/cycu200100158

摘要

高科技產品佔總出口的比重逐年增加，已成為台灣未來經濟的主要動力，而高科技產業附加價值高，國際競爭也格外激烈，為保有競爭的優勢，高科技產業需要不斷在研發，製程及管理上做可觀的投資，因此其特有的資訊就變成公司最重要的資產也亟需要安全的保護。處技術轉型期的台灣企業目前正是全盤檢討資訊安全的最佳時機。
本研究的目的是從文獻及在摩托羅拉台灣廠的工作經驗中找尋最適的安全資訊管理機制。雖然可確定的是沒有一套完美的機制，不過台灣廠商能夠儘早規劃及建構資訊安全管理系統並觀摩先進外商的做法相信可以降低資訊安全的風險到最低點，並確保台灣產業在國際上的競爭力。
在符合機密性，整體性及適用性的資訊安全三大原則下，設計安全系統的第一步驟是做好整體企業的風險及脆弱點評估，以便以有限的企業資源做最有效益的安全措施的運用。不過基本上，安全措施應與企業整體策略相結合，並需取得員工的承諾與支持才能確保安全計劃的成功。除了做風險評估外，其它需要考慮的步驟有：安全策略制定，資訊安全專責人員指派，安全計劃的內容及規範的細節，計劃的執行，員工訓練及追蹤考核等，如果以安全的領域來區分時，則可分為實體安全，運作程序安全，人員安全，系統資料安全及網路安全。
本論文報告最終獲得以下幾點結論：
1.資訊安全對公司重要投資及資產的保護無比重要，因此安全規劃應與公司整體營運策略相配合，而不應認為只是一種可有可無的計劃。
2.標竿國際高科技廠商的安全作業方式是一種省錢又可預知未來趨勢的最佳途徑。
3.訂定一套安全稽核清單，有利作業上的溝通及偵測可能的安全問題。
4.資訊安全是一種持續進行的過程，應定時檢討改進。
5.只有全員參與並負起應有的責任，才能保證整體安全系統的成功。

關鍵字

最佳實務 ； 資訊安全 ； 安全

並列摘要

High-tech products account for more than 30 percent of the total Taiwan’s export,high-tech sector apparently will keep providing Taiwan an engine for future growth and a model that is now being emulated by many Asian neighbors, it’s also facing new challenges in protecting intelligence information from competitors.
Intelligence information is the most valuable resource of high-tech companies, it’s loss or compromise can destroy an organization, therefore, how to protect corporate information asset in current fierce competition arena is a top priority for many companies.
The main purpose of this study is to search for the most suitable information security system and also the best practices from available documents and from author’s past experiences in Motorola Taiwan company, although there is no panacea for all the security problems in the internet age but if to start the efforts earlier to deal with an ever-increasingly complex set of problems systematically and to follow the best practices then it should be a great help for local companies to minimize potential security risks and maintain it’s future competitive advantages.
On the premise of three most important security principles: Confidentiality, Integrity and Availability, the first suggested step in designing the information security system is to determine what are the company’s risk management issues and decide what level of vulnerability a company can afford, but the bottom line is that security must meet organization’s business objectives, and to ensure full supports from all employees’ compliance is definitely a key element to carry out information security system successfully.
Security project should cover following processes: (1) Risk assessment; (2) Security Policy; (3) Appoint Security organization; (4) Security plan; (5) Security Implementation; (6) Awareness and Training; (7) Monitor, Feedback, Review and Adapt. and there are five main Security domains : (1)Physical Security; (2) Operational/Procedural Security; (3) Personnel Security; (4) System and Data Security; (5) Network Security.
My report obtains following conclusions:
(1) Security is vital in protecting company’s investment in technical and other resources, therefore, security should be treated as important as a part of company’s strategy rather than as a trifle afterthought , developing a security system should be within a well-defined and risk-based concept.
(2) To bench mark the best practices of international companies of high-tech industry should be a suitable approach to save security developing cost and understand the future security trends.
(3) To develop a security checkpoint list in each security process for use to monitor and control the compliance also to identify the threats and vulnerabilities should be the easiest and effective communication method with management levels and all employees.
(4) Security is a continuous process and not an end product in itself, security should be reviewed at a regular intervals.
(5) Only employees are aware of that security is organization’s first priority issue and hold them for responsibility and accountability then a successful security system can be guaranteed.

並列關鍵字

information security ； security ； best practice

參考文獻

3. Tipton, Harold F., 1999, Information Security Management

Handbook, Auerbach Publishers

Computers and Networks, CRC Press

6. O’Brien, James A., 2000, Introduction to Information Systems,

7. Anderson Ross, 2001, Security Engineering, John Wiley & Sons