- 學位論文
以Fuzzy AHP建立國軍資訊安全管理系統風險評估準則
Establishing the Risk Assessment Criteria for the Information Security Management System of the Military with the Fuzzy Analytic Hierarchy Process
摘要
在國防安全領域中，資訊安全一直佔有舉足輕重的角色，近年來，國軍各單位推動ISMS作業上更是不遺餘力，ISMS是一套有系統的分析和管理資訊安全風險的方法，其目標是透過控制方法，把資訊風險降低到可接受的程度內，因此，「風險管理」是資訊安全的最重要的核心工作之一。 國軍目前不乏通過ISO27001認證單位，但是仍有資安事件的發生，深究原因大致上是因為風險評估工作做的不扎實。風險評估作業是依照單位主觀的認知，在參考條文說明來執行，一般人因為不想投入太多資源來做後續的風險管理計畫，因此在開始的階段，就把風險評鑑作業作的很鬆，這樣一來，就會發生許多潛存高風險的資產被低估（忽視），而沒有真正的實施有效的風險管理，因次，認證雖然通過了，但是資安事件的發生卻不會停止。 在國防預算持續緊縮的情形下，如何將有限資源投注在處理關鍵風險，已成為重要課題之一，本篇以國軍資安管控作業為研究範圍，旨在發展一個適用於國軍資訊安全管理系統的風險評估準則，根據專家及文獻發展7大構面及54項威脅之架構，以FUZZY AHP之方法收集並分析個威脅之權重，提供各單位可依據戰（演）訓任務特性及本研究建議準則，快速執行風險評估作業，並以有限的資源針對高風險項目實施管控降低風險，以精實投資效益。
並列摘要
Information system security is vitally important to the national defense. In recent years, the military departments did their utmost to advance the information security management system (ISMS). It is a method to systematic analyze and manage the risk of the information security system. The aim of the ISMS is to lower down the risk to an acceptable level through controlling. Therefore, the most important core task of the information security is risk management. Many military departments passed the ISO 27001 certification, but the information security events still occurred frequently because the risk assessment didn’t do well. The related units didn’t want to invest too many resources to do the risk management program. They assessed the risk according to the subjective judgments and reference regulations. Consequently, the risk evaluation was done loosely and many high-risk assets were be underestimated. It is important to invest the limited resources to deal the key risk. The aim of the paper was to develop the risk assessment criteria for ISMS of the military. According to the experts’ opinions and references, the framework including 7 dimensions and 54 items was established. Through the fuzzy AHP, the experts’ judgments would be collected and analyzed. The results could be applied to every military department to prompt execute the risk assessment. Consequently, the unit can control and reduce the high-risk threats with the limited resources.