資料載入處理中...
臺灣人文及社會科學引文索引資料庫系統
:::
網站導覽
國圖首頁
聯絡我們
操作說明
English
行動版
(3.145.173.78)
登入
字型:
**字體大小變更功能,需開啟瀏覽器的JAVASCRIPT,如您的瀏覽器不支援,
IE6請利用鍵盤按住ALT鍵 + V → X → (G)最大(L)較大(M)中(S)較小(A)小,來選擇適合您的文字大小,
如為IE7以上、Firefoxy或Chrome瀏覽器則可利用鍵盤 Ctrl + (+)放大 (-)縮小來改變字型大小。
來源文獻查詢
引文查詢
瀏覽查詢
作者權威檔
引用/點閱統計
我的研究室
資料庫說明
相關網站
來源文獻查詢
/
簡易查詢
/
查詢結果列表
/
詳目列表
:::
詳目顯示
第 1 筆 / 總合 1 筆
/1
頁
來源文獻資料
摘要
外文摘要
引文資料
題名:
資訊資產分類與風險評鑑之研究--以銀行業為例
書刊名:
資訊管理學報
作者:
陳志誠
/
林淑瓊
/
李興漢
/
許派立
作者(外文):
Chen, Patrick S.
/
Lin, Shu-chiung
/
Li, Shing-han
/
Shi, Perry
出版日期:
2009
卷期:
16:3
頁次:
頁55-84
主題關鍵詞:
資訊資產
;
資訊安全
;
風險評鑑
;
Information assets
;
Information security
;
Risk assessment
原始連結:
連回原系統網址
相關次數:
被引用次數:期刊(
1
) 博士論文(0) 專書(0) 專書論文(0)
排除自我引用:0
共同引用:0
點閱:21
企業的資訊安全作法繁多,但不一定能聚焦於最需要之處,以及考慮到成本與時間效益。因此,為企業資訊資產進行分類與建立風險評鑑機制,不僅可以得到資訊資產詳細的風險等級,也可使資訊安全管理決策更精確、完整及有效,避免資訊安全事件的發生。目前國內外有關資訊資產風險評鑑的研究不多,本研究對重視資訊資產管理的銀行業進行研究,以國內某知名銀行為例,由資訊安全管理之作業要點BS 7799-1:2000、資訊安全系統規範BS7799-2:2002和資訊技術安全管理指導綱要ISO/IEC TR 13335做為問卷設計的依據,再以美國國家技術標準局(NIST)於2001年制定的「資訊科技系統風險管理指導」三項程序,進行風險管理。研究中由個案公司的資訊資產清冊中選出十一類24項較可能發生資安事件的資訊資產,使用德菲法進行資料收集分析,評估出資訊資產的相關威脅、弱點及風險等級,同時進行定性與定量的風險分析。研究結果說明個案公司資訊資產風險等級為中等者只有主路由器一項,其餘均為低等級,基於BS 7799-2:2002持續改善的原則,研究中對高風險等級的資訊資產提出建議及改進措施。由於銀行業的資訊環境具有高度雷同性-主要核心業務放在大型主機,外圍由中小型伺服器處理非帳務性系統,且研究個案之規模和資訊系統在銀行業中具有代表性,本研究獲致之成果具實務上的參考價值,可協助企業降低資訊資產風險與資安事件的發生。
以文找文
Many incidents of information systems result in imperfect protection of information assets. Since overall protection is expensive, even impossible, security measures should be made at the most needed places in terms of cost and time. By means of classification of information assets and their risk assessment, we are able to know the degree of risk of the assets and to achieve a better decision in security measures. Owing to the secrecy policy, research reports on risk assessment of information assets are rarely made public. In this research we classified the information assets of a financial institution and assessed their risks. Because the institution is one of the major banks in Taiwan, the research results should be representative. The Delphi method was adopted in this research and the questionnaires were designed based on the guidelines of information security management of BS 7799-1:2000, BS 7799-2: 2002 and ISO/ IEC TR 13335. In total, 24 information assets subject to security breaches were chosen for risk assessment, and 7 experts in information security and computer auditing were invited to answer the questionnaires concerning current value of the assets, possible threats, vulnerabilities and degree of risks. Risks are expressed in low, medium and high, ranging over 10 degrees on risk scale. The results revealed that there is one item, the core router, with medium risk while others are of low risk. We also made suggestions for enhancing security measures for all assets with risk degree greater or equal to 2. Owing to the lack of publications of researches on classification of information assets and assessment of their risk in financial field, the results achieved in this study is of practical value.
以文找文
期刊論文
1.
Ward, S. C.(1999)。Assessing and Managing Important Risks。International Journal of Project Management,17(6),331-336。
2.
Liebowitz, Jay(1999)。Key Ingredients to the Success of an Organization's Knowledge Management Strategy。Knowledge and Process Management,6(1),37-40。
3.
Rowe, G.、Wright, G.(1999)。The Delphi Technique as a Forecasting Tool: Issues and Analysis。International Journal of Forecasting,15(4),353-375。
4.
Chapple, A.、Rogers, A.。Explicit Guidelines for Qualitative Research: A Step in the Right Direction, a Defense of the Soft Option, or a Form of Sociological Imperialism?。Family Practice,15(6),556-561。
5.
De Meyrick, J.。The Delphi Method and Health Research。Health Education,103(1),7-16。
6.
Dhaliwal, J. S.、Tung, L. L.。Using Group Support Systems for Developing Knowledge-based Explanation Facility。International Journal of Information Management,20(2),131-149。
7.
Fink, D.。IS Security Issues for the 1990s: Implications for Management。Journal of Systems Management,46(2),46-49。
8.
Fowles, J.。An Overview of Social Forecasting Procedures。Journal of the American Institute of Planners,42(3),253-263。
9.
Gallagher, M.、Hares, T.、Spencer, J.、Bradshaw, C.、Webb, I.。The Nominal Group Technique: A Research Tool for General Practice?。Family Practice,10(1),76-81。
10.
Grant, J. S.、Kinney, M. R.。Using the Delphi Technique to Examine the Content Validity of Nursing Diagnoses。International Journal of Nursing Terminologies and Classifications,3(1),12-22。
11.
Greenhalgh, T.、Taylor, R.。Papers That Go beyond Number。British Medical Journal,315(7110),740-743。
12.
Groom, P. D.。The IT Security Model。Potentials IEEE,22(4),6-8。
13.
Gupta, U. G.、Clarke, R. E.。Theory and Applications of the Delphi Technique: A Bibliography (1975-1994)。Technological Forecasting and Social Change,53(2),185-211。
14.
Harris, S. J.。Proactive Service Management: Leveraging Telecom Information Assets for Competitive Advantage。IEEE Network Operations and Management Symposium,35(15-19),700-710。
15.
Hoddinott, P.、Pill, R.。A Review of Recently Published Qualitative Research in General Practice: More Methodological Questions than Answers。Family Practice,14(4),313-319。
16.
Iheagwara, C.。More Effective Risk Assessment:Using Cascading Threat Multipliers for Assessing Intrusion Detection Systems in Complex Infrastructures。Computer Security Journal,19(2),8-20。
17.
Jones, R.。Why Do Qualitative?。British Medical Journal,311(6996),2-2。
18.
Kuo, N. W.、Yu, Y. H.。Policy and Practice: An Evaluation System for National Park Selection in Taiwan。Journal of Environmental Planning and Management,42(5),735-745。
19.
Malterud, Q. K.。Qualitative Research: Standards, Challenges, and Guidelines。The Lancet,358(9280),483-488。
20.
Mendoza, G. A.、Prabhu, R.。Development of a Methodology for Selecting Criteria and Indicators of Sustainable Forest Management: A Case Study of Participatory Assessment。Environmental Management,26(6),659-673。
21.
Munier, F.、Ronde, P.。The Role of Knowledge Codification in the Emergence of Consensus under Uncertainty: Empirical Analysis and Policy Implications。Research Policy,30(9),1537-1551。
22.
National Institute of Standards and Technology。Risk Management Guide for Information Technology Systems。Special Publication,800(30)。
23.
Pasukeviciute, I.、Roe, M.。The Politics of Oil in Lithuania: Strategies after Transition。Energy Policy,26(3),383-397。
24.
Powell, R.、Single, H.。Methodology Matters - V, Focus Group。International Journal for Quality in Health Care,8(5),499-504。
25.
Rodriguez-Diaz, A. J.。Globalisation and Technology Management in the Mexican Food Industry。Industrial Management and Data Systems,100(9),430-435。
26.
Saunders, C. S.、Jones, J. W.。Measuring Performance of the Information System Function。Journal of Management Information System,8(4),63-82。
會議論文
1.
陳志誠、許派立。資訊資產分類管理與控制之研究-以金融業者為例22-22。
延伸查詢
2.
Budgen, P. J.。Why Risk Analysis?1-4。
3.
Hoqqanvik, I.、Stolen, K.。Risk Analysis Terminology for IT-systems: Does It Match Intuition?1-10。
4.
Perna, J.。Leveraging the Information Asset451-452。
5.
Vorster, A.、Labuschagne, L.。A Framework for Comparing Different Information Security Risk Analysis Methodologies95-103。
學位論文
1.
瞿鴻斌(2005)。資訊安全風險評估驗證系統(碩士論文)。世新大學。
延伸查詢
2.
王秀文。一個針對共通作業環境中資訊資產風險評估模式。
延伸查詢
3.
吳俊儀。ISO9000知識創造模式之探討。
延伸查詢
4.
林耀垣。應用德菲法及資料包絡分析法於我國地方政府施政績效評估之研究。
延伸查詢
5.
張芳珍。以BS7799落實資訊安全管理-管理類資訊資產分類與控管。
延伸查詢
6.
劉智敏。運用BS7799建構資訊安全風險管理指標。
延伸查詢
7.
鄭年華。企業資訊安全風險評鑑模式之研究。
延伸查詢
8.
蕭吉宏。機敏軍事單位資訊安全風險分析之研究。
延伸查詢
圖書
1.
陳志誠。電子商務犯罪與偵防。電子商務安全。臺北。
延伸查詢
2.
Goldman, A. E.、McDonald, S. S.。The Group Depth Interview: Principles & Practice。The Group Depth Interview: Principles & Practice。Englewood Cliffs, NJ。
推文
當script無法執行時可按︰
推文
推薦
當script無法執行時可按︰
推薦
引用網址
當script無法執行時可按︰
引用網址
引用嵌入語法
當script無法執行時可按︰
引用嵌入語法
轉寄
當script無法執行時可按︰
轉寄
top
:::
相關期刊
相關論文
相關專書
相關著作
熱門點閱
1.
建構雲端環境資料安全存取模型暨績效評估
2.
從「ISO17799」的導入論國軍資訊資產控管--以後備司令部為例
3.
以ISO 27001控制標準稽核證券商網路下單系統資訊安全之研究
4.
具有或閘失誤樹於銀行批次作業之風險模式建構
5.
資訊安全風險評鑑驗證系統
1.
考量控制措施間相互影響性之資訊安全風險評鑑
2.
ISO9000知識創造模式之探討
無相關書籍
無相關著作
無相關點閱
QR Code