以BS7799為基礎評估軍事單位資訊安全環境之研究：以國軍M單位為例

Study of Information Security with BS7799 in Military Organization：A Case Study on M Organization

許雪蓮(Hsueh-Lien Hsu)

指導教授 ： 曾德宜

大同大學/經營設計學院/資訊經營學系所/碩士(2006年)

摘要

近年來，資訊危安事件屢見不鮮，由美國電腦安全局及聯邦調查局CSI/FBI對於電腦犯罪及安全所做的調查統計顯示，多數資訊危安事件均是由組織內部人員所造成，這是組織使用再好的資訊技術也無法防範的威脅；在2005年澳洲電腦犯罪與安全調查報告顯示，採行資訊安全標準的比率已由2003年的37%增加到2005年的65%，由此可知，資訊安全已從過去講求技術層次（如防火牆產品）演化至管理制度面。
有鑑於軍事單位建立資訊安全管理系統之迫切性，本研究將以BS7799資訊安全管理標準為基礎，透過問卷調查方式，深入瞭解軍事單位人員就導入BS7799資訊安全管理標準及10大控制要項之看法，並針對調查結果進行分析與討論，希冀此研究結果能提供國軍在建立資訊安全管理制度上之參考依據。
主要研究發現為：
國軍M單位人員對BS7799標準整體看法，「重要程度」與「落實程度」間有顯著差異，普遍受測者認為單位內實施各控制要項之落實程度均未達重要程度的要求。
資訊安全運用上最重視的控制要項，得分最高前三項為：【系統開發與維護】、【符合性】、【安全政策】；落實程度最差的控制要項，得分最低三項為：【營運持續管理】、【實體與環境安全】、【通訊與操作管理】。
透過IPA分析，應專心致力改善之控制要項為：【安全政策】、【人員安全】。
不同工作單位性質之受測者，對BS7799標準導入決策因素認知看法，以【內部組織誘因】層面有顯著差異，且資訊部門人員認同程度高於非資訊部門人員。
在【安全政策】控制要項上，主管階層對於【安全政策】重要性認知顯著高於操作人員。
在【安全政策】、【人員安全】、【實體與環境安全】、【存取控制】、【系統開發與維護】等控制要項上，顯示出志願役重要性認知顯著高於義務役；在【符合性】控制要項上，志願役及聘僱人員重要性認知均顯著高於義務役。

關鍵字

資訊安全 ； 資訊安全管理標準 ； BS7799

並列摘要

In recent years, there are more and more information security cases. As shown in the survey report by US Computer Security Institute (CSI) and Federal Bureau of Investigation (FBI), most information security cases are caused by internal employees in the organization, which can not be prevented with any advanced information technologies. Australian ‘Computer Crime and Security Survey Report’ in 2005 also shows that the ratio of organizations which have introduced security standards has increased from 37% in 2003 to 65% in 2005. The two reports indicate that information security has evolved from technological level (for example, firewalls) to management mechanism level.
Because military organizations have more urgent demand for information security management systems, this paper discusses the response of military staff members to the introduction of the information security management standard (BS7799) and the related ten control sections. Questionnaires were sent to military staff members, analysis and discussion are made based on collected data in the hope of providing some reference for military organizations.
Main research discoveries are:
Staff members of M organization have different overall views about BS7799. There is big gap between ‘important level’ and ‘implementation level’. Most respondents answered that the implementation level of each control section does not reach the important level they thought.
Among sections of the information security standard, ‘System Development and Maintenance’, ‘Compliance’ and ‘Security Policy’ score the top 3, while ‘Business Continuity Management’, ‘Physical and Environmental Security’ and ‘Communication and Operations Management’ rank the lowest three.
Through the IPA analysis, it is found that the most important sections to be improved are ‘Security Policy’ and ‘Personnel Security’.
Testes from different units have different reviews about factors in introducing BS7799. Particularly, they have significant difference in ‘internal organization inducement’ and members of information units have more self-identity than members of non-information units.
In the section of ‘Security Policy’, high level members have more cognizance than operators.
In sections of ‘Security Policy’, ‘Personnel Security’, ‘Physical and Environment Security’, ‘Access Control’, and ‘System Development and Maintenance’, voluntary servicemen have significant higher cognizance than compulsory servicemen. In the section of ‘Compliance’, voluntary servicemen and hired men have significant higher cognizance than compulsory servicemen.

並列關鍵字

Information Security ； Information Security Management Standard ； BS7799

參考文獻

[15] 黃士銘、張碩毅、蘇耿弘，「企業導入BS7799資訊安全管理系統之關鍵成功因素－以石化產業為例」，資訊管理學報，2005年4月。

[23] 葉俊榮（民94）。電子化政府資通安全發展策略與展望。研考雙月刊，29卷。

[32] 蒲樹盛（民94）。資訊安全管理系統(ISMS)-IS017799/BS7799國際認證體系與稽核驗證介紹。研考雙月刊，29卷1期，PP.91-104。

[37] BSI.(2002), “Information security management- Part 2: Specification for information security management systems”, BS7799-2:2002, BSI(British Standards Institution).

[12] 侯皇熙（民93）。植基於BS7799 探討政府部門的資訊安全管理─以海關資訊部門為例。國立成功大學工程科學系碩士論文。