主機安全稽核工具之設計與實現

Design And Implementation Of A Host Audit Tools

彭及福(Chi-Fu Peng)

指導教授 ： 洪智力

中原大學/商學院/資訊管理研究所/碩士(2015年)

https://doi.org/10.6840/cycu201500580

摘要

網際網路的發達及資訊技術的日新月異，促進了日常生活的便利，卻也陸續衍生出許多與資訊安全相關的電腦犯罪類型及風險，涵蓋範圍廣泛，從個人、組織單位甚至於國家皆或多或少受到了不同程度的影響，如何讓資訊受到適當的保護、控管及維持可用性，成為了一個非常重要的議題。因此，為了能夠更有條理、效率的去管理這些有形、無形的重要資產，英國標準協會（BSI）於1995年，提出了一套有系統的分析和管理資訊安全風險的方法－BS7799，也就是現今國際上被廣泛採用的安全管理制度標準規範，ISO 27001的前身。國際標準組織為了將資訊安全的層面擴大，更將其發展成ISO/IEC 27000系列標準，系列中包括ISO 27001、ISO 27002、ISO 27003、ISO 27004等標準。當中，為了因應資訊安全發展的趨勢及變化，新版的ISO 27001:2013更將管理領域由原本的11個修訂為14個。有感於目前的主機設備(伺服器、桌機、筆電)稽核人員於稽核過程中，尚未有一個較為全面性的稽核工具，用於協助其進行風險評估的作業，且並非稽核人員都具有資訊安全的經驗，如此可能會產生稽核不夠完善的情形，故於本研究中，將會以ISO 27001:2013中的「存取控制」、「密碼」、「作業安全」及「通訊安全」等四個管理領域的條文做為方針，設計及開發一個系統化之主機安全稽核輔助工具，讓稽核人員能夠藉由系統化的操作，即可以快速得知可能影響主機安全的相關資訊。另外，也可以藉由檢測出來的結果，進一步要求相關人員針對不足之處，做後續的調整及改善。最後透過本系統，讓稽核人員對主機設備（筆電、桌機及伺服器）的稽核工作變的更加確實及便利。

關鍵字

ISO 27001 ； 資訊安全 ； 資訊安全工具 ； 主機稽核

並列摘要

The rapid development of the Internet and progress in information technology have brought convenience to daily life, but many information security-related computer crimes and risks have also resulted, with different extents of impact reaching far and wide from individuals, organizations, to countries. How to properly protect, control, and maintain the usability of information has become a very important issue. Hence, in order to manage the important tangible and intangible assets in a more organized and efficient manner, the British Standards Institution (BSI) has proposed a method known as the BS7799 for the systematic analysis and management of information security and risks; BS7799 is also the predecessor of ISO27001, the current security management system standard widely used internationally. In order to expand the information security level, the International Organization for Standardization (ISO) has even developed the ISO/IEC27000 series standards, including ISO27001, ISO27002, ISO27003, ISO27004, and so on. In particular, in response to information security development trends and changes, the new version of ISO27001: 2013 has even modified the original 11 control objectives into 14. Since auditors of current host equipment (servers, desk computers, and notebook computers) still lack a more comprehensive auditing tool to assist in risk assessment operations during auditing processes and that not all auditors have information security experiences, the situation of improper auditing may result. Therefore, the articles in four management fields, namely, “access control,” “password,” “operation safety,” and “communications safety,” in ISO27001: 2013 served as the guidelines in this study to design and develop a systematic host security auditing assistive tool to enable auditors to rapidly acquire information related to host security through systematic operations. In addition, based on test results, relevant staff will be further required to make subsequent adjustment and improvement on inadequacies. Finally, this system enables auditors to more properly and conveniently audit host equipment (notebook computers, desktop computers, and servers).

並列關鍵字

ISO 27001 ； Information Security ； Information Security Tools ； Host Audit

參考文獻

security management systems -- Requirements”ISO,2013.

Prentice Prentice Hall, pp. 296,2003.

[13] 孫淑景，內控處理準則電腦資訊循環之個案研究-以BSI7799資訊安全及COBIT控

Practice for Information Security Management”ISO,2005.

security management systems -- Requirements”ISO,2005.