植基於資通安全治理建構資訊安全風險評估機制－以國軍某單位為例

Construction of Information Security Risk Evaluation Mechanism on Information Security Governance-A Case Study on Military

李俊傑(Chun C. Li) ； 尹延齡(Yen L. Yin) ； 林明昌(Ming C. Lin)

《國防管理學術暨實務研討會》 第十八屆 (2010/06) Pp. 454-471

https://doi.org/10.29497/GFGL.201006.0454

摘要

近年來國軍在資訊安全防護上不遺餘力，但就建構完整資通安全防護體系，仍需有前瞻性之作為，本研究植基於資通安全治理、資訊安全管理系統要求ISO/IEC 27001:2005及資訊安全風險管理ISO/IEC 27002:2005，對映COBIT風險分析流程，以個案組織之資訊資產風險評鑑及專家研討，運用決策樹安全指標機率模型與資產風險連動方法，提高風險值估算的準確率；透過實例研究發現，除了大型主機設備HA (High availability)架構等級不足造成硬體設備故障威脅及主路由器單一點的故障產生通訊網路服務中斷外，其餘弱點及威脅均屬於內部管控問題，最後以ISO/IEC 27002:2005提出改進控制措施，以降低風險至組織可接受程度。因而在本研究中，建立了一套植基於資安治理之資訊安全評估機制，並可提供各類型國軍組織運用。

關鍵字

資通安全治理 ； ISO27001 ； ISO27002 ； COBIT ； 風險評估

並列摘要

Although in recent years the military authorities have tried their best to improve the information security, there is still a need to build an integrated system for the entire information security. Based on the published documents and standards, including information security governance, ISO/IEC 27001, ISO/IEC 27002 and COBIT, the main purpose of this research is to conduct a whole risk assessment for the information assets in a military unit. We use Delphi method and questionnaires to collect and input the data to information assets risk interaction and security meter probability model in decision tree. Except that the HA (High availability) of the mainframe computer will not make its failure a threat and that the malfunction of core router in a single node will interrupt communication service, we found that the other weaknesses and threats can be handled by internal control. Finally, we suggest some control procedures to monitor the critical risks to a level acceptable by this military unit.

並列關鍵字

Information Security Governance ； ISO27001 ； ISO27002 ； COBIT ； Risk Evaluation