資訊安全政策實施對資訊安全文化與資訊安全有效性影響之研究

A Study of the Effect of Implementing Information Security Policy on Information Security Culture and Information Security Effectiveness in an Organization

蘇建源(Chien-Yuan Su) ； 江琬瑂(Wan-Mei Chiang) ； 阮金聲(Jin-Sheng Roan)

《資訊管理學報》 17卷4期 (2010/10) Pp. 61-87

https://doi.org/10.6382/JIM.201010.0061

摘要

隨著組織對資訊化依賴程度愈深，所面對的資訊安全威脅就愈多。組織除了擁有資訊安全技術外更須要一套資訊安全政策供組織有一致的管理標準來遵循。然而許多組織已建立資訊安全政策，還是難以避免許多資訊安全事件發生，究其原因是輕忽安全管理重要性的組織文化。本研究將探討資訊安全政策實施的管理活動與建立資訊安全文化之關係與影響性。針對國內大型企業的資訊主管進行問卷調查並使用結構方程模型進行資料分析。研究結果顯示：
1. 資訊安全教育與宣導、高階主管支持、違反資訊安全規範懲處對資訊安全文化有正向顯著的影響。
2. 資訊安全文化對知覺資訊安全有效性有正向顯著影響。
3. 資訊安全政策維護對制訂資訊安全政策文件有顯著的影響。

關鍵字

資訊安全政策 ； 資訊安全文化 ； 資訊安全有效性

並列摘要

Organizations nowadays rely highly on the information technology to achieve its daily operation demand. Due to the continual occurrence of many information security incidents, the protection of information systems is a major problem faced by organization. For an organization's information security, it is not only a technical issue but also a management issue. The application of an IS security policy is one of the major mechanisms employed by IS security management.
The purpose of this study is to explore the effect of implementing an information security policy on information security culture and information security effectiveness in promoting the activities about information security policy. According to the large business ranking of top 1000 by China Credit Information Service, Ltd., we conducted a questionnaire survey of the MIS department manager. Structural Equations Modeling (SEM) was applied to analyze the data and the main findings of the study are as follows.
1. The implementation of an information security policy has positive impacts on information security culture.
2. Information security culture has positive impacts on perceived information security effectiveness.
3. The maintenance of an information security policy has positive impacts on making the documents of information security policy.

並列關鍵字

Information Security Policy ； Information Security Culture ； Information Security Effectiveness

參考文獻

林妙雀(2005)。企業之智慧資本與分享組織文化對組織管理績效影響之實證研究。管理評論。24(1)，55-81。

(ISO ISO/IEC 27001:2005, International Organization for Standardization, Switzerland, 2005.).

Adams, J. S.,Tashchian, A.,Shore, T. H.(2001).Codes of Ethics as Signals for Ethical Behavior.Journal of Business Ethics.29(3),199-211.

Allen, B.(1968).Danger Ahead! Safeguard Your Computer.Harvard Business Review.46(6),97-101.

Andress, M.,Fonseca, B.(2000).Manage People to Protect Data.InfoWorld.22(46),48-.