企業BYOD資訊安全風險模式之建構與探討

A study on Construction of the Corporate BYOD information security risks guideline

李宜唐(YI-TANG LEE)

指導教授 ： 洪為璽 ； 古政元

國立中正大學/管理學院/資訊管理學系/碩士(2016年)

摘要

企業BYOD資訊安全風險模式之建構與探討
研究生：李宜唐 指導教授：古政元、洪為璽 博士
摘要
在現今的時代，IT的消費化，帶動了「使用自己的私人裝置工作」(Bring Your Own Device)的一股浪潮，而企業組織在管理上，如何化BYOD趨勢為外部競爭優勢，輔助決策者達成企業目標，首要必須評估導入BYOD趨勢的資訊安全風險，建立一套適用於企業的「BYOD資訊安全風險模式」，成為鞏固企業資訊安全重要的環節之一。本研究針對學術資料庫及資訊安全組織網站，進行BYOD資訊安全風險及威脅等關鍵字進行文獻收集，彙整文獻中各層面相關之資訊安全風險，再合併相關內容，提出初步構面及準則，進行德爾菲法修正，以建構本模式之歸類正確性。再以AHP（層級分析程序法）決定構面與模式之權重，以其結果，透過專家深度訪談，進行說明分類及排序之深入內涵，以獲得實務面之結論。
結果顯示，以構面而言，企業認同「行動軟體安全」及「通訊安全」的技術面風險管理，為最高度重視的部分；再以保護勞資雙方資料隱私為首的「隱私安全」及「實體安全」構面，制定「遵循性安全」風險規範，而「相容性安全」及「成本及生產力」是風險排序較後的部分，代表以企業角度而言，資訊軟硬體的整合性問題是可被解決的，企業不會因BYOD的管理成本而抗拒投入，反而必需針對不同層面的資訊安全威脅控制其直接的風險，以增加其員工向心力及生產力。期盼本研究能幫助各產業單位及組織，在面臨全球化競爭環境且行動科技之高度發展之下，能適切選擇BYOD控管，協助組織策應外部環境之變動，並提供業界做為改善企業資訊安全防護的參考。

關鍵字

IT消費化 ； 層級分析程序法 ； 行動裝置 ； 資訊安全

並列摘要

A study on Construction of the Corporate BYOD information security risks guideline
Author：Yi-Tang Lee Advisor：Dr. Cheng-Yuan Ku Wei-Hsi Hung
Abstract

Nowadays, consumerization of IT has pushed forward a massive upsurge in BYOD (Bring Your Own Device). However, for the management of business organizations, in order to make the trend of BYOD an external competitive advantage and help decision makers achieve business goals, it is a priority to evaluate the information security risks of BYOD. Therefore, it turns out to be an important step to design a “BYOD Information Security Management System (ISMS)”. Aiming at academic databases and websites of ISMS, this present study was mainly designed to conduct literature reviews with keywords related to information security risks and threats of BYOD. The researcher collected as well as organized different aspects of information security risks, integrated them together, and indicated both initial dimensions and norms. Based on Delphi method, the researcher proofread and corrected so as to make sure of the accuracy and validity. Lastly, determining on weighting of the dimensions and modes on the basis of AHP, according to the results, the researcher conducted depth interview to explain the profound implications of categorization and arrangement with the aim of gaining practical conclusion.
The results showed that in terms of the dimension, business organizations have a common consensus of placing high importance on technical risk management of both mobile application security and communication security. They intend to establish compliance security norms according to the dimension of privacy and physical security which regard protecting privacy of labor-management as priority. In light of “the compatibility security” and “costs and productivity”, both of them are regarded as the latter ones in the risks rank. All of these suggests that from the view of business organizations, the compatibility of software and hardware are solvable, and they do not refuse to join due to the costs of management; instead, they are more likely to control immediate risks aiming at certain aspects of threats in information security so as to reinforce the coherence and productivity of employees. Under the highly competitive and mature environment of mobile technology, this study is expected to help industries and organizations handle challenges from exterior with the proposed BYOD management system, and in hopes of offering business organization reference materials of improving business information security.

Keywords: BYOD, information security, mobile device, AHP, IT consumerization

並列關鍵字

Consumption IT ； Information security ； Mobile device ； Analytic Hierarchy Process (AHP) ； BYOD

參考文獻

20. 林金定, 嚴嘉楓, & 陳美花. (2005). 質性研究方法: 訪談模式與實施步驟分析. 身心障礙研究季刊, 3(2), 122-136.

5. 賴香菊, 黃三益, 梁定澎, 洪新原, & 吳祥麟. (2011). 台灣資訊管理學術單位學術期刊論文發表狀況. 資訊管理學報, 18(3), 175-196.

19. 萬文隆. (2004). 深度訪談在質性研究中的應用. 生活科技教育月刊， 三十七卷, (4), 17-23.

1. Alberts, C., & Dorofee, A. (2001). OCTAVESM Threat Profiles. Pittsburgh, Software Engineering Institute.

3. Barbará, D. (1999). Mobile computing and databases-a survey. Knowledge and Data Engineering, IEEE Transactions on, 11(1), 108-117.