企業資訊安全機制導入與評估–以H公司為例

The mechanism of information security of enterprise is channelled into and assessed - Take H Company as an example.

王拜文(Bay-wen Wang)

指導教授 ： 周惠文

國立中央大學/管理學院/資訊管理學系碩士在職專班/碩士(2008年)

摘要

企業在目前網路的環境中，面臨的網路威脅、資訊安全議題的層面既深且廣，一方面要利用網路及資訊化所帶來的便利，一方面也要提防資訊科技帶來的威脅與恐懼，對於企業經營者來說，每項設備、資本的投資，都必須是為企業帶來效益，市面上的各種資訊安全方案在導入企業內使用後，其達到防範的效果為何? 防止外部入侵及阻止員工外洩資料途徑的方法有那些? 都是管理者在評估、規劃時需要深入了解的。
本研究透過個案研究的方式，深入探討個案公司在尚未導入資訊安全機制的網路架構，及所面臨的資訊安全相關威脅，剖析個案公司所導入之資訊安全機制的項目及成效。透過本研究針對個案公司導入資訊安全機制之研究及分析評估，提出改善及建議事項，而個案公司所提出之資訊安全機制，亦可做為其他企業導入之參考，可縮短導入資訊安全機制之時程。
經由研究分析本個案後，歸納的研究結論如下：
(一) 先將攻擊的路徑減少到最低，才能有效的阻隔攻擊事件的發生。
(二) 企業內的資訊安全政策及員工教育訓練也是重要的課題，建立員工良好的使用資訊系統的習慣，才可大大降低因無知而造成的危機。
(三) 資訊安全的政策需明文規定，並且公佈讓全體員工皆能了解，透過資訊部門不定時的進行資訊安全宣導，都是可以協助資訊安全工作的行政手法。

關鍵字

資訊安全 ； 入侵防禦 ； 垃圾郵件 ； 行為監控 ； 即時通訊

並列摘要

In the environment of the network at present of enterprise, network threat, aspect of the topic of information safety faced are deep and wide, the facility that on one hand should utilize the network and informationization to bring, on the other hand will even watch out for the threat and frightened that information science and technology bring, to enterprise''s operator, the investment of each equipment, capital, must bring benefit to enterprises, after the scheme of various kinds of information safety on the market is used in channelling enterprises into, why does it get the result of taking precautions against? Are there those in preventing the outside from invading and method to stop letting out way of the materials outside the staff? All what administrators need to understand in depth while assessing and planning.
This research probes into the network structure that the case company has not been channelling into the mechanism of information safety yet thoroughly through case study way, and the relevant threats of information security faced, analyze the project and effect of the mechanism of information safety that the case company channels into. Assess to research and analysis which the case company channel into the mechanism of information safety through this research, propose improving and proposing the item, and the mechanism of information safety which the case company put forward, can also run it for the reference that other enterprises channel into, can shorten Cheng while channelling into the mechanism of information safety.
Via researching and analysing a case, the research conclusion summed up is as follows:
(1) Reduce route that attack to most low first, could effective to separate emergence of attack.
(2) The policy of information safety and staff''s education and training in enterprises are important subjects, set up the good habits of using the information system of staff, can just reduce the crisis caused by that ignorant greatly.
(3) The policy of the information safety needs to express regulations, and announce that enables the staff to understand, carrying on information to declare and lead safely when through the information department is indefinite is all the administrative tactics of assisting information security in information security''s work.

並列關鍵字

Information Security ； Intrusion Prevention System ； SPAM Mail ； Behavior Controlling ； Instant Messenger

參考文獻

陳李綢，1996，「個案研究」，台北：心理出版社。

李為漢，2005，「網際網路惡意程式之活動調查－以某企業對外網路連線為例」，國立中央大學資訊管理學系碩士論文。

張維仁，2007，「犯罪心理與員工電腦濫用行為之研究」，國立中央大學資訊管理學系碩士論文。

黃克仲，2007，「以URL資訊為基礎之網路釣魚偵測系統」，國立中央大學資訊工程研究所碩士論文。

劉永禮，2002，「以BS7799資訊安全管理規範建構組織資訊安全風險管理模式之研究」，元智大學工業工程與管理學系碩士論文。