| 摘要(英) |
Due to the development of technology and the popularity of financial services, more and more banks are bringing technology into the services offered by their organizations. Although technology brings convenience, it also brings risk. In Taiwan, the first hacking of a bank ATM system in the history occurred in 2016, with a total loss of over NT$80 million. In 2017, hackers successfully hacked Far Eastern International Commercial Bank′s international remittance system, SWIFT, and transferred NT$1.8 billion in remittances overseas. Banking is an ancient industry with a long history. To face the digital transformation, can traditional financial executives understand the risks brought about by information technology?
This study compares and analyzes the information security systems of the financial industry in Taiwan with other financial centers (e.g., the United States, Hong Kong, the United Kingdom, Australia) through the analysis of national regulations and the publications of various international organizations. In addition, the study explains the internal audit best practices of various international organizations, and through case summaries analyzes the information security-related penalties announced by the Financial Supervisory Commission, the financial authority in Taiwan, and the major events and related news, to understand from internal auditor′s point of view whether the occurrence of events is due to system or regulations deficiencies. The study also compares the penalized cases with the best practices to identify where the audit function could be improved.
The results of this study show that the CFI issued by the Hong Kong authority, HKMA, is most comprehensive information security regulation, while the other major financial centers generally lack systematic requirements and do not have relevant requirements for internal auditing. The domestic authority does not even have a specific law on information security in the financial industry. The improvement of information operations of the organization should be emphasized both systematically and institutionally, and the audit operations related to information operations of the internal audit function should be conducted by professional information internal auditors, and emphasis should also be placed on confirming whether the system of control measures has been established. |
| 參考文獻 |
【中文文獻】
周伯翰（2022），「銀行法暨金融控股公司法（四版）」。台北：元照出版社。
胡述兆主編（1995），「圖書館學與資訊科學大辭典」。台北，漢美圖書有限公司。
劉真主編（2000），「教育大辭書」。台北：文景書局。
蘇明君（2018），「銀行法令遵循制度相關問題之研究-以法遵、法務角色差異及重大裁罰個案為中心」，國立政治大學法學院碩士在職專班碩士論文。
【英文文獻】
Bank of England (2021), “Operational resilience of the financial sector,” (accessed 2022/12/31, available at https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector)
Hong Kong Monetary Authority (2021), “Cybersecurity Fortification Initiative (CFI),” (accessed 2022/1/18, available at https://www.hkma.gov.hk/eng/key-functions/international-financial-centre/fintech/research-and-applications/cybersecurity-fortification-initiative-cfi/)
Information Systems Audit and Control Association (2019), CISA Review Manual, 27th Edition. Schaumburg: Information Systems Audit and Control Association
The Australian Prudential Regulation Authority (2022), “Information security requirements for all APRA-regulated entities,” (accessed 2021/11/21, available at https://www.apra.gov.au/information-security-requirements-for-all-apra-regulated-entities)
The New York State Department of Financial Services (2021), “23 CRR-NY I 500,” (accessed 2022/1/30, available at https://govt.westlaw.com/nycrr/Browse/Home/NewYork/NewYorkCodesRulesandRegulations?guid=I5be30d2007f811e79d43a037eefd0011&originationContext=documenttoc&transitionType=Default&contextData=(sc.Default))
【網頁】
Bank for International Settlements (2021), “History – overview,” (accessed 2021/12/13, available at https://www.bis.org/about/history.htm)
Bank for International Settlements (2022), “The Basel Committee - overview,” (accessed 2021/12/13, available at https://www.bis.org/bcbs/)
Bank for International Settlements (2012), “The internal audit function in banks,” (accessed 2021/12/30, available at https://www.bis.org/publ/bcbs223.htm)
Bank of England (2022), “History | Bank of England,” (accessed 2022/1/3, available at https://www.bankofengland.co.uk/about/history)
CNN (2000), “Western Union Web hack attributed to ′human error′,” (accessed 2021/5/30, available at https://edition.cnn.com/2000/TECH/computing/09/13/western.human.error.idg/index.html)
Council of the European Union & European Parliament (2018), “General Data Protection Regulation (GDPR) Compliance Guidelines,” (accessed 2022/1/9, available at https://gdpr.eu/fines/)
International Monetary Fund (2022), “World Economic Outlook, Real GDP growth,” (accessed 2022/4/3, available at https://www.imf.org/external/datamapper/NGDP_RPCH@WEO/OEMDC/ADVEC/WEOWORLD)
The Institute of Internal Auditors (2020), “THE IIA′S THREE LINES MODEL,” (accessed 2022/1/12, available at https://www.theiia.org/globalassets/site/about-us/advocacy/three-lines-model-updated.pdf)
Wikipedia (2022a), “Elk Cloner,” (accessed 2021/5/17, available at https://en.wikipedia.org/wiki/Elk_Cloner)
Wikipedia (2022b), “Hong_Kong,” (accessed 2022/1/23, available at https://en.wikipedia.org/wiki/Hong_Kong)
Wikipedia (2022c), “Information technology audit,” (accessed 2021/4/30, available at https://en.wikipedia.org/wiki/Information_technology_audit)
Wikipedia (2022d), “十信案,” (accessed 2022/2/3, available at https://zh.wikipedia.org/zh-tw/十信案)
中央社（2019a），「全台 ATM 大當機，只因工程師誤觸「一條線路」，https://buzzorange.com/techorange/2019/10/18/atm-crash-because-of-engineer-error/，存取時間2022/2/12。
中央社（2019b），「調客戶資料發現錄音檔不見 元大銀被罰200萬元」，https://taronews.tw/2019/08/13/432904/，，存取時間2022/2/18。
中華民國內部稽核協會（2022），「國際內部稽核執業準則」，https://www.iia.org.tw/standarditl.aspx?id=87，存取時間2022/4/29。
中華民國國家發展委員會（2012），「金融監督管理委員會掛牌上路」，https://www.ndc.gov.tw/nc_575_21862，，存取時間2022/12/29。
中華民國電腦稽核協會（2011），「電腦稽核專業倫理規範」，https://www.caa.org.tw/about.php?id=ethics1，存取時間2021/4/29。
中華民國銀行商業同業公會全國聯合會（2016），「中華民國銀行商業同業公會全國聯合會」，https://www.rootlaw.com.tw/LawArticle.aspx?LawID=A040390040028000-1050923，存取時間2022/1/18。
林士涵（2010），「出身櫃員 高茂森領軍銀行資訊化 從無到有建立系統 親力參與累積經驗」，https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/B23FC839E7014FC1A39BEA5138106DFE，存取時間2022/2/25。
卓庭鈺（2020），「臺灣金融控股股份有限公司及所屬臺灣銀行股份有限公司110度營業預算評估報告」，https://www.ly.gov.tw/Pages/Detail.aspx?nodeid=44830&pid=206541，存取時間2022/2/23。
林資傑（2017），「誤刪巨量交易資料，中信銀挨罰200萬元」，https://www.chinatimes.com/realtimenews/20171129001760-260410?chdtv，存取時間2022/2/2。
金融監督管理委員會（2021），「金融監督管理委員會全球資訊網」，https://www.fsc.gov.tw/ch/index.jsp，存取時間2021/12/10。
金融監督管理委員會（2022），「裁罰案件-金融監督管理委員會全球資訊網」，https://www.fsc.gov.tw/ch/home.jsp?id=131&parentpath=0,2，存取時間2022/2/1。
翁芊儒（2021），「iThome 2021 CIO大調查（中）｜IT人力趨勢」，https://www.ithome.com.tw/article/144840，存取時間2022/1/11。
高敬原（2020），「富邦銀行停機48小時升級，但災情不斷、客服被打爆！官方怎麼說？」，https://www.bnext.com.tw/article/59527/taipeifubon-upgrade-system，存取時間2022/3/8。
張家嘯（2017），「遠東商銀SWIFT系統遭駭 不實跨境交易未得逞」，https://www.cardu.com.tw/news/detail.php?33924，存取時間2021/4/3。
黃彥棻（2016），「駭客入侵一銀ATM流程追追追」，https://www.ithome.com.tw/news/107294，存取時間2021/4/4。
黃彥棻（2017），「遠銀遭駭追追追 - 更多入侵細節大公開！18億元遠銀遭駭盜轉事件追追追」，https://www.ithome.com.tw/news/117397，存取時間2021/4/28。
黃彥棻（2020），「臺銀海外分行爆發商業電郵詐騙千萬，臺銀列為人為疏失，金管會要求加強控管」，https://www.ithome.com.tw/news/137591，存取時間2022/1/18。
溫貴香（2012），「買二手硬碟 赫見銀行往來個資」，https://tw.news.yahoo.com/買二手硬碟-赫見銀行往來個資-042308383.html，存取時間2022/3/15。
鄭國強（2021），「中信銀薪轉戶金融卡被集體盜刷 專家：駭客可能用高速電腦破解」，https://tw.news.yahoo.com/news/金融資安示警-中信銀薪轉戶金融卡被集體盜刷-專家-駭客可能用高速電腦破解-075637192.html，存取時間2022/3/15。
謝方娪（2021），「券商爆重大資安事件 金管會清查3家遭撞庫攻擊」，https://money.udn.com/money/story/5613/5928162，，存取時間2022/3/2。
戴瑞瑤（2019），「驚爆系統當機存款歸零 花旗銀行：已解決，不影響客戶權益」，https://finance.ettoday.net/news/1369498，存取時間2022/2/27。
蘇文彬（2013），「中國信託網路繳費中心個資外洩案，金管會開罰400萬元」，https://www.ithome.com.tw/news/82321，存取時間2022/2/28。 |
[Endnote RIS 格式]
[相關文章]
[文章引用]
[完整記錄]
[館藏目錄]
至系統瀏覽論文 (2027-6-30以後開放)
plurk
funp
live
udn
HD
myshare
netvibes
friend
youpush
delicious
baidu
Google bookmarks
del.icio.us
hemidemi
facebook
twitter
google
reddit