電信業驗證ISO27001關鍵成功因素之研究

The Critical Success Factors in Telecommunication Industry Certification ISO27001

蘇世豪(Shih-Hao Su)

指導教授 ： 邱光輝

國立臺北大學/商學院/企業管理學系/碩士(2010年)

摘要

在e化的快速發展之下，企業在資訊安全的考量下並未有隨著資訊化之腳步前進，層出不窮的資訊安全事件也時有所聞。組織往往等到遭遇資訊安全事件時才會驚覺在建構資訊化系統時忽略了資訊安全的考量。
資訊安全事件一旦發生於電信業內，將立即衝擊企業的營運，不論是有形的金錢損失或無形的商譽損失，將會因為一時的管理疏忽而毀於一旦，電信業者導入ISO 27001的重要性，確為目前各界及主管機關所關注的資安議題。ISO 27001標準可以幫助組織鑑別、管理和減少資訊設備所面臨的各種風險，這無疑的是提供組織最大的資訊安全的保護機制。
因此本研究希望能彙整電信業導入ISO 27001之經驗，萃取導入成功之因素，以期能對未導入ISO 27001 電信業者提供經驗之分享及建議方向。
本研究以台灣地區通過ISO27001認證某電信業為研究之對象，透過文獻探討與專家訪談方式確認本論文架構及關鍵成功因素，然後在針對研究對象進行問卷發放與回收，之後將這些資料利用德菲法來求取專家與電信人員導入ISO 27001關鍵因素間之差異。
最後，發現，對於導入ISO27001來說，公司的態度與資源投入、專職單位負責與顧問的協助才是導入成功的基礎，這些研究發現都應該被產業內公司的高層所重視，在因為產業間競爭需要導入資訊安全標準是必須的過程裡，應該要展現高度的組織承諾與支持，並轉化成替原有員工設立專職單位與尋找適切的顧問進行輔助，來達成成功導入ISO27001的目標。

關鍵字

關鍵成功因素 ； 資訊安全 ； ISO 27001 ； 德菲法

並列摘要

The critical success factors for telecommunication industry to imply ISO 27001 is depending on how fast the digitalization development, because of their own reasons, enterprises do not imply the advanced information technology. Most organizations build up their information security system after information issue happened. In fact, they should concern it before.
If any information security incident happened on any of the telecommunications company, the impact not only on its business operations, but it costs on its company reputation. Indeed, the government should pay more concern on information security issues, especially, we should focus on ISO 27001 on telecommunication industry.
ISO 27001 has many advantages, such as organization identified and management the risk of using IT equipments. With no doubt, it is the greatest information security protection mechanisms for any organizations.
Therefore, our study will focus on the experience of complying ISO 27001 on the telecommunication industry, and to organizes the successful factors. Furthermore, we hope to share any successful experiences to those companies which have not implied ISO 27001.
Our study will focus on a telecommunication company in Taiwan which has already implied ISO27001. We will use questionnaire and personal interview to get our raw data and organize with our study. Delphi method will be used for study the difference between those key factors.
At the end, we found the important aspects for implying ISO27001 are attitude of the company, resources of usage, specialist to in charge and the organization consultants and we will share our found to the top management at organization. During the process of implying information security standards, the organization should pay highly support. Setting up the specialized unit and hiring consultant are key-points to successful imply the ISO27001.

並列關鍵字

critical success factor ； information security ； ISO27001 ； Delphi method

參考文獻

王建華（2006），導入ERP系統各階段成功關鍵因素之研究─以M鋁擠型廠為例，長榮大學經營管理研究所未出版之碩士論文。

余崇洲（2005），政府資訊業務委外成功關鍵因素之研究，台灣大學資訊管理研究所未出版之碩士論文。

宋文娟 (2001)，「一種質量並重的研究方法—德菲法在醫務管理學領域之應用」，醫務管理期刊，2卷2期：11-20。

侯衍任（2006），網路電話服務業者之核心資源及關鍵成功因素研究，元智大學資訊傳播學系未出版之碩士論文。

連智民（2006），台灣中小企業自有品牌關鍵成功因素之研究，中興大學高階經理人碩士在職專班未出版之碩士論文。