A Model-based Checklist for Insider Threat Prevention

預防組織內部威脅事件之檢核表發展

劉宜樺

指導教授 ： 黃雪玲

國立清華大學/工學院/工業工程與工程管理學系/碩士(2010年)

摘要

在台灣雖然有許多心理量表可以供組織來衡量員工的心智狀況，但其無法針對是否有內部破壞者進行判斷。本研究目的為發展出一份適用於主管的組織安全檢核表。由本研究所建構的特殊徵兆起因與組織安全的模式及分析文獻中曾經發生過的內部破壞者事件，可發現內部破壞者在進行對整個組織有巨大影響的破壞之前，會有些特殊徵兆出現，這些特殊徵兆其背後有著不盡相同的原因。若是能發現這些徵兆，並且在內部破壞者進行更進一步破壞行動前進行處理，將可避免重大危安產生。
本研究先於某公司進行心理量測來了解該公司員工心理狀況與一般人的異同處，並利用結構式訪談了解目前組織使用何種策略來增加員工動機、向心力及排解員工壓力。而後建構出特殊徵兆起因與組織安全的模式，根據此模式發展出檢核表，分為「預防危害產生的策略」以及「內部破壞者可能徵兆」兩部分。藉由專家結構式訪談來修正檢核表中的策略及徵兆，使得檢核表具專家效度。最後利用問卷來評估檢核表的信度。
本研究發展出的檢核表邀請專家來進行評估，使此份檢核表具有內容效度。而檢核表在檢核特殊徵兆部分，其整體信度係數為0.91(Cronbach alpha) ，此檢核表信度達到可接受標準。此檢核表可用來協助組織單位，讓公司主管對於特殊徵兆與組織安全的關係有進一步的了解，利用此份檢核表找出組織內可能內部破壞者，以及了解使用何種策略來確保組織安全。本研究主要係發展一份檢核表來預防組織內部威脅事件進行探討，後續驗證則為未來研究目標。

關鍵字

內部威脅者 ； 工作壓力 ； 組織管理

並列摘要

There are some psychology measures for the organization to evaluate the mental status of the employees in Taiwan, but those measures cannot detect the insiders. The purpose of this study is to develop a checklist for the supervisors or unit heads that can apply to ensure the organization safety. Based on the model for causes of specific precursor and organization safety that structured by this study and analysis of the insider threat events by literature review, before the insiders try to execute the major malicious activity, there are some precursors. And those precursors are caused by different factors. If those precursors can be detected and be handled before the insider takes further acts, hazard will not happen.
At first, this study implements Chinese Basic Personality Inventory (CBPI) to figure out the similarities and differences of mental condition between the employees in certain company and the others, and takes place the structured interview to understand if the employee in certain company have stress what the strategies the supervisors will take. Then, the model for causes of specific precursor and organization safety is structured and the checklist is developed based on this model. The checklist is divided into two parts. One part is the strategies those are took to prevent risk happen, and the other part is the precursors those insider threats appear. Then, the structured interview with experts is taken place to modify those strategies and precursors in the checklist and to possess expert validity. Finally, the questionnaire is implemented to evaluate the reliability of the checklist.
The experts are recruited to evaluate this checklist to possess content validity. According to the high Cronbach’s alpha of the questionnaire (0.961), the reliability is acceptable. This checklist can be applied to the organization departments to help the supervisors to have a concept of the relationship between the precursors and the organization safety. It is helpful for the supervisors to check if there are potential insiders in their organization. Some strategies can be taken to ensure the safety of the organization. This study focuses on how to develop a checklist for insider threat prevention and applying this checklist is necessary for the further study.

並列關鍵字

Insider threat ； work stress ； organization management

參考文獻

Bosma, H., Peter, R., Siegrist, J., Marmot, M. (1998). Two alternative job stress models and the risk of coronary heart disease. Am J Public Health 88:68–74

Carnegie Mellon University's Computer Emergency Response Team (CERT) http://www.cert.org/

Chang, C.P. and Chang, F.J (2010), Relationships among traditional Chinese personality traits, work stress, and emotional intelligence in workers in the semiconductor industry in Taiwan. Qual Qunat 44: 733-748

Cheng, Y., Guo, Y.L., and Yeh, W.Y. (2001), A national survey of psychosocial job stresses and their implications for health among working people in Taiwan. International Archives of Occupational and Environment Health 74: 495-504

Cohen, S., & Bailey, D. E. (1997). What makes teams work: Group effectiveness research from the shop floor to the executive suite. Journal of Management, 23, 239-290.