影響國軍建構有效資安體系因素探討-FAHP之研究途徑

在歷年公布的研究報告中，台灣一直是駭客組織攻擊的重點國家，亦有眾多來自中國網軍所發起，且主要攻擊標定鎖定防護能力欠佳的公部門，以及軍事網路，期望能夠竊取更多寶貴國家機密，有鑑於網路攻擊日漸增加，當前國軍整體網路使用環境，如同全世界的網路一樣，隨著引進多元科技影響，正面臨著一個多樣化網路攻擊的威脅，因此必須提升整體資安防護等級；國內政府企業入侵事件頻傳，該怎麼預防？該如何防護？該如何練兵？如何讓已運作的機制發揮功效？目前資安部門人手不足，資安環境設備如何整合？如何獲取最新情資及如何確認資安防護等級符合國家標準？因此，影響國軍建構有效資安體系的關鍵因素，對維護國軍機敏資訊安全甚至國家整體安全來說是極為重要的。本研究透過專家意見法(Expert Opinion)訪談國軍資安主管，並建構出適用之研究雛型架構，之後運用模糊理論與模糊層級分析法（Fuzzy Analytic Hierarchy Process；FAHP），針對三軍各單位通資部門主管之問卷填答結果進行分析。研究結果顯示，「修訂完善資通安全管理政策」、「健全戰略層級網路戰指揮機制」、「引進新式科技強化系統防禦」、「聚焦AI技術發展應用策略」、「強化通訊網路跨域聯防機制」、「建立情資整合及預警中心」、「設立資安研發及培訓機構」及「強化資安風險維護管控原則」為影響國軍建構有效資安體系之關鍵因素。指標項目折線圖顯示，經國軍資通安全專家，一致認為影響國軍建構有效資安體系關鍵成功因素是政策法規與組織架構的落實執行，經研究分析後，國軍必須進一步提升整體資安防衛能力，因應我國軍數位化與科技化發展，以及國際資安法規發展趨勢，完備我國軍資安相關法規修訂及完善管理政策、並依網路戰攻擊展趨勢，健全網路戰指揮機制，透過計畫、查核、執行、行動(PDCA)循環，持續優化國軍資安整體運作機制，並逐年依國家科技發展，以及相對應的資安風險，調整國軍資安體系各組的角色及任務目標，聚焦引進新式科技與AI技術發展趨勢，強化於跨域聯防機制及情資整合預警中心，並投入資源積極培訓頂尖資安人才，落實單位資安風險管控，期望能提供國軍建軍備戰決策之參考，幫助國軍做好資安防護工作。

關鍵字

資安體系；網路戰；資訊戰；專家意見法；模糊理論與模糊層級分析法；多準則決策

並列摘要

From research reports published in recent years, Taiwan has always been a key country for hacker attacks. Due to poorly protected internet, Taiwan public sectors has witnessed most website attacks, some were suspected coming from the People's Liberation Army Strategic Support Force. They also try to attack the Taiwan Armed Forces’ Intranet for classified information. Taiwan military’s current intranet is facing the threats of diversified cyber attacks, which is a similar trend around the world, because of the introduction to multi-domain technologies; it is necessary to improve the information security protection of Taiwan military. Therefore, this document aims to address several issues: how often do the government sector and enterprise intrusion incidents happen? What is the prevention measure? How to train people for information security protection? Does the current mechanism work? Currently our country has not have enough personnel assigned at all levels of information protection sectors, do we integrate hardware and software? How can we have access to the up-to-date information and how do we make sure the protection level reach to the country level standard? From the questions above, this paper summarizes the above key factors vital for Taiwan Armed Forces and even the country to build an effective information security protection system. This study interviews security supervisors of Taiwan Armed Forces through Expert Opinion method, and constructs an applicable research structure, and then applies the Fuzzy Analytic Hierarchy Process (FAHP) to analyze responses from various units of three services in Taiwan military. The results of questionnaire answered by supervisors were analyzed and showed several key factors for Taiwan Armed Forces to build an effective information security system; these factors include: “revise and improve current information security management policy”, “enhance cyber operation command mechanism of strategic level network”, “Introduce new technology to strengthen information protection”, “focus on AI technology development and application strategy”, “strengthen cross-domain network protection”, “establish intelligence integration and pre-warning center”, “set up information and communication technology R&D and training institution”, and “reinforce risk management regulations for information security. The indicator chart in the study reveals information and communication security experts of Taiwan Armed Forces have all agreed on the key factors for successful information security system. These factors are well-developed, fully implemented policies and organizational structure. Taiwan Armed Forces must further enhance its information security capability through several measures: following the trend of technology development and international information security laws and policies, to enhance relevant military regulations and management policies; observing the trend of cyber warfare for better command and control; applying planning, checking, implementation, and action (PDCA) cycle to optimize Taiwan Armed Forces’ information security mechanism; accessing technology development and potential risks to adjust the roles and missions of all echelons; focusing on the trend of new AI technology and to strengthen cross-domain protection of communication network; invest resources for training information security talents to better manage all echelons. The above measures are for Taiwan Armed Forces to ponder a better future for information security protection.

並列關鍵字

Information Security system ； Cyber warfare ； Information warfare ； Expert Opinion ； Fuzzy Analytic Hierarchy Process ； FAHP ； Multi-Criteria Decision Making.