軍事單位人員對資訊安全管理系統導入意向之研究

由於近代網路科技的迅速發展，給人類生活帶來更多的便利也促進了工作的效率，而軍事單位為了保持基本戰力與提高工作效能，對於資訊系統的倚賴也愈來愈重，然而也衍生了資訊安全的議題，對於軍事單位造成嚴重威脅。在軍事單位裡工作的相關人員，包括軍職人員、聘雇人員、受訓員生、洽公民眾、工程承包商等，都是可能直接或間接取得軍事資訊的高風險群。如何確保重要的國防資訊不致遭受有心人士的竊取、破壞、蒐集等，更是目前面臨的重要挑戰議題。雖然早在民國99年國防部已頒訂「國軍資訊安全政策」，並依據ISO/IEC 27001國際標準導入資訊安全管理系統，然而違反資訊安全規定的事件仍然層出不窮。因此本研究選定某軍事單位的相關人員進行調查訪問，以瞭解哪些因素會影響人員遵行資訊安全規範的意向。本研究應用「解構計劃行為理論」探討軍事單位人員遵守資訊安全行為意向的影響因素。發放問卷進行訪問調查，並進行資料分析。研究結果顯示：(1)知覺有用性與相容性對行為態度有正向影響、(2)主管及同儕影響對主觀規範有正向影響、(3)自我效能與資源促進條件對知覺行為控制有正向影響、(4)行為態度與知覺行為控制對軍事單位人員遵守資訊安全規範意向有正向影響。此外，本研究調查結果發現仍有約8%的單位人員缺乏資訊安全觀念或不清楚資訊安全的規定為何。本研究建議軍事單位應導入資訊安全管理系統認證，並且多加強資訊安全教育及宣導，強化單位人員的安全意識，如此方能提高單位人員遵守資訊安全規範意向之強度，同時可以有效降低違反資訊安全規定的事件發生率。

關鍵字

資訊安全；資訊安全管理系統；解構計劃行為理論；行為意向

並列摘要

In recent years, network technology development very fast so that improve human quality of life and efficiency of the work, but military department in order to keep basic force and grow working efficiency that information system depend will be more important, however derivative the information security issue will serious a threat to military department. A person working in military department like army, employ, trainees, business trip man and construction contractor etc. They maybe become high risk group that direct or indirect get military information. How to guarantee that important defense information don’t encounter people with bad intention with Steal, destroy and gather is even more a major challenge topic on this moment. Although Ministry of National Defence(R.O.C) was publish ”Information Security Policy of the Military” in 2010 and according to ISO/IEC27001 international standard included Information security management system; However, breach of information security provision event always happened so this study will select some military department related person to investigate and find out which factors will affect people intentions of obey information security specifications. This research utilize” Decomposed Theory of Planned Behavior” to discuss soldier obey information security behavior intentions that influence factor and send questionnaires to survey and data analysis. The results proved: (1) Perceptual usefulness and compatibility have a positive effect on behavioral attitudes; (2) Supervisors and peers have a positive impact on subjective norms; (3) Self-efficacy and resource-driven conditions have a positive effect on perceived behavioral control; (4) Behavioral attitudes and perceived behavioral controls have a positive impact on military units' compliance with information security norms. Beside, survey results found out that approximately 8% people insufficient information security cogitation or unclear what is in information security provision, it is suggested that import Information security management system authentication and increase information security education and propaganda, intensify people security consciousness so that people will grow information security provision intentions be strengthened, meanwhile, violate information security provisions probability will be effective reduce.