運用稽核機制持續改善ISO 27001認證後績效之研究－以某行政機關為例

資訊與網路科技快速發展，帶來快捷及便利性，而且資料與資訊系統扮演越來越重要的地位，行政機關亦被要求以新興的資訊與網路科技協助業務的改善及推動，加速作業流程，達到簡政便民的目的。行政機關因應法規要求，每年都需要進行資安稽核驗證，以發掘是否存在資安缺失，並提出缺失改善建議。藉由資安稽核與持續改善，將可以促進行政機關的資安防護績效，發掘資安漏洞，減少安全風險。本研究蒐集某行政機關近三年稽核所發現的資安缺失及改善建議事項，採用「比較研究法」分析這些缺失及建議事項的異同之處，並進行歸類以找出最常出現的資安缺失及改善建議事項。然後再採用「半結構式訪談法」，設計訪談問卷，選定行政機關內部的資訊人員及一般業務人員做為受訪對象實施訪談，以探討如何採行有效的資安防範對策，實施必要的資訊安全管制措施，並探討行政機關在推動資訊安全管理機制之後，藉由資安稽核與持續改善，是否對於資訊安全防護帶來正向的改善效果？研究結果顯示：(1)行政機關在稽核時，最常發現的資安缺失類型為：保全區域、使用者存取管理、資產責任。(2)針對近年稽核所常發現的資安缺失，受訪的資訊人員皆能夠提出對應的防範對策，並實施必要的資訊安全管制措施。(3)藉由持續不斷的實施資訊安全改善措施，對於資訊安全防護上確實可以帶來正向的改善效果。本研究成果將可供行政機關做為推行及持續改善資訊安全管理機制的參考，將資源做有效的利用，降低對單位正常作業造成額外負擔，同時可以避免不必要的資安風險。

關鍵字

資訊安全管理；稽核發現及建議； ISO 27001認證

並列摘要

The rapid development of information and network technology has brought about speed and convenience. Data and information systems play a more important role. Administrative agencies are required to use emerging information and network technologies to assist business improvement and promotion, accelerate operational processes, and achieve the goal of simplifying administration and facilitating the people. In response to the requirements of laws and regulations, administrative agencies need to conduct security audits and verifications every year to find out whether there is a lack of security and make suggestions for improvement. Through security audit and continuous improvement, it will promote the security protection performance of administrative agencies, discover security loopholes, and reduce security risks. 　　This research collects information about security deficiencies and suggestions for improvement discovered by an administrative agency in the past three years. We used the "comparative research method" to analyze the similarities and differences between these deficiencies and recommendations, and categorized them to identify the most frequently occurring security loopholes. This study used the "semi-structured interview method" to design interview questionnaires, selected information personnel and general business personnel within administrative agencies as interviewees to conduct interviews, in order to explore how to adopt effective security precautions and implement necessary information security controls. It also discussed whether the administrative agencies, after promoting the information security management mechanism, through information security audits and continuous improvement, would bring positive improvements to information security protection? 　　The results revealed the facts that: (1) The most common types of security deficiencies discovered by administrative agencies during audits were: security areas, user access control, and responsibility for assets. (2) In response to the lack of security often found in audits in recent years, the interviewed information staff were able to propose corresponding preventive measures and implement necessary information security controls. (3) By continuously implementing information security improvement actions, it could indeed bring a positive improvement effect on information security protection. 　　The results of this research can provide administrative agencies as a reference to implement and continuously improve the information security management mechanism, make effective use of resources, reduce the additional burden on the normal operation of the unit, and avoid unnecessary security risks.