由於電腦及網路的發達，企業和政府組織實施電腦化，以減少勞動力，材料和財務投資，及實現便捷和有效的服務。因此，資訊安全的重要性正在不斷地增加，相關資訊安全管理的議題也變得更為重要。很多研究採用多準則決策方法（MCDM）去評估風險有關的問題。在多準則決策方法中，妥協性排名方法（名為 VIKOR）被視為能處理多準則決策的一種適用技術。它適用於複雜系統的多目標最佳化。但是，在折衷解的方法上，很少有文章討論這些具有著相依性和回饋性的衝突（競爭）準則。同樣地，也很少有研究計算具相依性和回饋性準則整合的風險或評估風險控制措施實施的績效。因此，本研究提出了一個創新多準則決策模型，使用VIKOR結合 DEMATEL技術與ANP來解決準則間具有非獨立性和回饋性的問題。本研究利用DEMATEL技術，建立準則間的網絡關係圖（NRM），並以NRM為依據採用網絡分析法（ANP）去建構這些具有交互作用和回饋的準則或方案。還使用DEMATEL技術對ANP的未加權超矩陣做正規化，以改善它符合現實的世界。此外，提出一個VIKOR修正版以符合實務需求，最後，使用一個評估風險控制措施的實證來說明所提出方法。其結果顯示該方法能有效的幫助管理者驗證風險控制措施的有效性。 As a result of the development of computers and computer networks, corporations and government organizations have implemented computerization to (i) reduce labor, materials, and financial investment, and (ii) achieve convenient and effective services. Therefore, the importance of information security is steadily increasing. The issue of information security management has become more significant. Many studies adopt multiple-criteria decision-making (MCDM) methods to assess risk-related problems. Among the MCDM methods, the compromise-ranking method, named VlseKriterijumska Optimizacija I Kompromisno Resenje in Serbian or VIKOR, which means Multicriteria Optimization and Compromise Solution, was introduced as an applicable technique within the MCDM framework. It was developed for multicriteria optimization of complex systems. However, few articles discuss the dependence and feedback of conflicting (competing) criteria in the compromise-solution method. Similarly, few studies calculate the integrated risks or assess the performances of the implemented risk controls after taking account of the dependence and feedback among criteria. Therefore, this research proposes a novel MCDM model using VIKOR-combined the decision-making trial and evaluation laboratory (DEMATEL) technique with the analytic network process (ANP) to solve the problems of conflicting criteria that show dependence and feedback. DEMATEL technique is used to build a network-relationship map (NRM) among criteria and the ANP to model, based on the NRM, the interdependence and feedback among criteria or alternatives. Moreover, DEMATEL technique is also used to normalize the unweighted supermatrix of the ANP to improve it for suiting the real world. In addition, a revised VIKOR is proposed for pratical needs. Finally, an empirical application of evaluating the risk controls is used to illustrate the proposed method. The results show that the proposed method is effective in helping managers validate the effectiveness of risk controls.
