企業整體資訊安全架構探討 -- 以Windows系統平台為例

全球電腦應用的普及率因為各國政府與商業需求的推動之下愈來愈廣，再加上網際網路近幾年來的蓬勃發展，電腦已經深入每一個人的生活變成大家日常生活中不可或缺的工具。網際網路這樣一個龐大的訊息與交易平台帶來無限的商機與便利性，但新的威脅也伴隨著而來，過去幾年資訊安全的事件層出不窮且逐年升高，所造成的損失也愈來愈大，在目前的網路環境下，企業面臨同樣嚴重的資訊安全威脅。　　不幸的是今天企業內部的運算環境跟過去非常的不一樣，從過去集中式的運算環境轉變成現在的分散式環境，部門式較小的系統取代了以往的大型主機系統，而且環境分散，企業IT的環境比以前來的複雜釵h。微軟自1995年推出Windows 95作業系統以來，因為簡單的使用者介面加上內建的網路弁遄A使用者的學習成本不高，開始被廣泛的接受，往後幾年更在微軟不斷推出新的產品及推廣下，Windows系統平台在全球個人電腦的市場佔有率很高，因為這個原因Windows系統平台遂成為攻擊的主要目標。過去兩年針對Windows系統平台的病毒攻擊事件層次不窮，企業在沒有適當的防範之下損失很大，Windows系統平台的安全性因其使用率在目前更顯得重要及被重視。　　本研究主要針對企業之資訊安全解決方案為探討的主題並以Windows系統平台為主要之研究重點，採用風險管理及評估的方法，建構企業整體資訊安全解決方案。在過去一年以來微軟針對資訊安全方面做了很多努力，除了產品的改進之外提供了相當多有關資訊安全維護的實際作法，資訊安全的維護需要人員、程序及技術三方面互相的配合，今天不管是使用哪種系統平台，如果企業有正確的資訊安全觀念，應用風險管理程序，了解IT環境所面臨的安全威脅及風險，採用適當的防禦措施結合微軟所建議之系統補強方法及安全修正程式管理程序及技術，很多資訊安全方面的問題可以避免。當然沒有任何的安全防護是一定100%安全的，但是只要有適當的防禦措施就可以將損害做一定的控制，再配合緊急應變措施及災難回復計畫，在Windows系統平台之下一樣可以達到企業的資訊安全的目標。

關鍵字

企業資訊安全；風險管理； Windows系統平台；網路威脅

並列摘要

The government and commercial demands prompt the expansion of the global computer application and the prosperous development of the Internet makes the computer a necessity in everyone’s daily life. However, the business opportunities and convenience brought by the massive messaging and trading platforms in the Internet are also accompanied by the new threat and the potential for increasing damages. In this Internet environment, the business is facing a serious information security threat. The computing environment of the business today differs from the past environment in that the current computer environment has been transformed into a distributed environment from the centralized environment. The mainframe system has been replaced by many smaller departmental servers. The IT environment is thus getting complicated. Since Microsoft Windows 95 system was out to the market in 1995, the simple user interface, built in functions and low learning cost have made the computers widely accepted. Windows system platform’s market share was further increased due to the availability of new products and consistent promotion by Microsoft. The said factors have made the Windows system platform a main target for attack. In the past few years, there have been numerous viruses which aimed at the Windows platform, and the businesses without appropriate protection deeply suffered. The importance of the security of the Windows platform is thus increased in light of the wide usage of such platform. This thesis primarily addresses the information security solutions for businesses and the research focuses on the establishment of the overall information security solutions on the Windows system platform by means of the risk management and security approach. In the past year, Microsoft has made a lot of efforts in the field of information security, and provided for many solutions related to information security in addition to the product improvements. To achieve information security requires the combination of the personnel, procedures and technology. If the enterprises have accurate information security knowledge, apply risk management procedures, understand the security threat and risk faced by the IT system, adopt appropriate defense measures in combination with the system hardening and security patch management procedures and technology, the information security problems may be avoided. There are no 100% safe protection measures, but appropriate defense measures may control the damages to the minimum. The foregoing, combined with the urgent emergency measures and disaster recovery plan, will be the means to achieve the goal of the business information security even under the Windows system platform.

並列關鍵字

Network Threat ； Enterprise Information Security ； Windows System Platform ； Risk Management

參考文獻

【9】Bass, Tim and Robichaux, Roger. “Defense-In-Depth Revisited: Qualitative Risk Analysis Methodology for Complex Network-Centric Operations”, 2001.

【14】Krause, Micki and Tipton Harold F., Handbook of Information Security Management, Auerbach Publications, CRC Press LLC, Fall 1997.

【17】Meritt, James W. “A Method for Quantitative Risk Analysis”, Computer Security Resource Center (CSRC), 1999.

【19】Rosser, Erroll X. “Building a Global Information Security Strategy”, Arthur Andersen, March 1999.

一. 中文部份

Google Scholar

國際替代計量

企業整體資訊安全架構探討 -- 以Windows系統平台為例

全文下載

主題瀏覽