已驗收的資訊系統真能符合資通系統防護基準要求？以 A 公司專案為例;Has an Accepted Information System Really Met the Requirements of the Cybersecurity Protection Standards? A Case Study a Project of Company A

NCU Institutional Repository > 管理學院 > 資訊管理學系碩士在職專班 > 博碩士論文 > Item 987654321/95437

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/95437

Title:	已驗收的資訊系統真能符合資通系統防護基準要求？以 A 公司專案為例;Has an Accepted Information System Really Met the Requirements of the Cybersecurity Protection Standards? A Case Study a Project of Company A
Authors:	蔡明宏;Tsai, Ming-Hung
Contributors:	資訊管理學系在職專班
Keywords:	資通安全法;資訊安全管理系統;軟體開發;軟體物料清單;事件紀錄;Cyber security Act;ISO/IEC 27001;SDLC;SBOM;System log
Date:	2024-05-29
Issue Date:	2024-10-09 16:51:31 (UTC+8)
Publisher:	國立中央大學
Abstract:	近年來，網路攻擊頻繁發生，資訊安全問題備受關注。為加強資安防護，政府頒布一系列法規和標準，對組織的資安管理提出更高要求。在此背景下，如何確保資訊系統安全，成為政府機關與資服業者共同面臨的重大課題。本研究以資服業者承接的政府專案為例，採用個案研究來探討中小型資服業者在滿足客戶需求和遵循資安標準中的挑戰。聚焦分析資訊系統在符合「資通系統防護基準」的程度或差異，並提出改善對策。研究使用文件分析、深度訪談、屬性抽樣等質性方法，以資通安全管理法及子法、ISO/IEC 27001、CBE、SBOM 等為依據，從專案管理、開發測試、供應鏈管理、稽核實施等角度，梳理專案的資安管理情況，找尋問題與不足。研究發現，中小型資服業者受限於資源、客戶需求多變、人員能力參差等因素，在落實資安控制時面臨諸多困境。專案暴露需求不明確、安全控制不完善、供應鏈管理鬆散等問題，難以全面符合「資通系統防護基準」要求。據此，研究提出強化變更管理、引入威脅建模、落實安全編碼規範、完善元件管理、細化稽核日誌、加強安全意識培訓等建議，以幫助中小型資服業者提升專案的安全品質，強化整體資安防護，平衡合規要求和成本效率。本研究深化了對資安標準落實的微觀理解，揭示了合規驅動資安治理的侷限性，對主管機關和產業界推動完善資訊系統的安全有啟示的意義。;In recent years, frequent cyber attacks have heightened concerns over information security. To strengthen data protection, the government has implemented various regulations and standards, increasing demands on organizational security management. This study focuses on a government project undertaken by an IT service provider, using case studies to explore the challenges small and medium-sized IT firms face in meeting client needs while adhering to security standards. The research employs qualitative methods such as document analysis and in-depth interviews to evaluate the project′s adherence to "Information System Protection Standards" and identifies areas for improvement. Findings reveal that these firms struggle with resource limitations, fluctuating client demands, and varying staff capabilities, leading to unclear requirements, inadequate security controls, and loose supply chain management. Consequently, the study suggests enhancing change management, threat modeling, security coding practices, component management, audit logs, and security awareness training to improve project security quality and strengthen overall data protection, balancing compliance requirements with cost-efficiency. This research deepens the understanding of security standard implementation and highlights the limitations of compliance-driven security governance, providing insights for regulatory bodies and the industry to improve information system security.
Appears in Collections:	[資訊管理學系碩士在職專班 ] 博碩士論文

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	44	View/Open

社群 sharing

Loading...