資訊安全管理系統建置初始工作的研究

Size: px

Start display at page:

Download "資訊安全管理系統建置初始工作的研究"

桦郭姬
5 years ago
Views:

1 43 * ** *** *** * ** *** ISO 9000 ISO A Study on the Implementation of Information Security Management Systems Abstract During the 90's, global civilization went through a great change. Quality of life, preservation of our environment, and management of human health and safety all turned gradually toward universal consistency and toward a high level of standardization. Related international standards have influenced economic development as well as operations in corporate organizations. Best examples are the compliance with the series of ISO 9000 standards for quality management and ISO standards for environmental protection. In the last month of the twentieth century, an international standard for the emerging field of information security management was adopted by ISO, the standardization body. The standard offers guidelines for establishing reliable and safe environment for information processing and communication. In this article, the authors describe the approach and steps for systematic implementation of information security management systems under the guideline of this newly adopted standardiso Key Words: Information Policy, Information Security Management System, Risk Assessment, Risk Management, Standard

2 ,000 N.T.$1,300,000, [1] U.S.$6,500,000.- U.S.$37,600, %[6] [5] (International Organization for Standardization, ISO) (Information technologycode of practice for information security management) ISO/IEC 17799[14] (Information Security Management System, ISMS) / ,000 N.T.$1,300,000, SOGO N.T.$300.-

3 45 1 N.T.$8,000.-~N.T.$9, ,200~1,300 N.T.$50,000.-~N.T.$70, N.T.$10,000, ( ) ( ) ( 5. SOGO 6. ISO/IEC (E) (Covert Channels and Trojan Code)

4 46 ISO/IEC ISMS ISO/IEC (British Standard Institute, BSi) 1999 BS7799 (Part 1) BS7799 (Part 2) (Specification for information security management systems)[9] (Certification Body)ISMS ISMS ISO/IEC BS7799 ISO/IEC ISMS (Organization for Economic Cooperation and Development, OECD) OECD BS7799 (International Organization for Standardization, ISO) ISO DIS BS7799 (ISO) OECD BS (Adequacy Standard) BS7799 ISO BS ISO ISO/IEC (?): ISO BS7799

5 AOL U.S. $3, U.S. $80,000, AT&T 6~26 1. U.S. $40,000, ~ E*Trade Charles ~ Schwab& Co % U.S. $70,000, ebay 2 1.U.S. $3,000,000.-~U.S. $4,000, % 20% 40% 40% ISO/IEC ( )

6 / / / 2. 2, SET(Secure Electronic Transaction) 6. ISO/IEC (Systems Development and Maintenance) (User Registration) BS

7 ISMS ISMS, 3, 4 BS 7799, 5 BS ISMSInformation Security Management System 1. ( ) (Risk Analysis) (Risk Evaluation) (Gap Analysis) (Patch) [4] ISO/IEC

8 50 7. BS7799 ISO/IEC BS7799 P-D-C-A (Plan-Do-Control-Action) BS ISO/IEC BS7799 ISO/IEC BS7799 [12] (Risk Assessment) / 3.1 [13] (Risk Management)

9 51 4 4

10 52 3.1

11 () 3.2IEC(International Electrotechnical Commission) IEC 1508

12 54 (Catastrophic) (Critical) (Marginal) (Negligible) 3.4 (Certificate Authority, CA) (2001) (code-red) (worm)[8] 4% ( (Microsoft) 6 18 ) 3.2

13 55 [7] BS [3,15,17] (Hazard) 3. (Estimation) (Evaluation) 1. (Tolerability) (Assessment) (Management)

14 (Guidelines) [11] (2001)2001 Web 76~ (2001) ~ (2001) Web % ~ % 24%16%42% ~

15 (Worm) ISO/IEC (E) (Malicious Software) (Scanner) (Patch)

16 58 3.3BS BS ISO/IEC ISO/IEC ISO/IEC ISO/IEC ISO/IEC ISO/IEC ISO/IEC ISO/IEC NIST FIPS (Federal Deposit Insurance Corporation, FDIC) (Division of Supervision, DOS) [2](Electronic Banking Safety and Soundness Examination Procedures,

17 59 S&S Exam.) 1. (Level 1) (Information-only) 2. (Level 2) (Electronic Information Transfer) 3. (Level 3) (Fully Transactional Information) BS ~4.10 (BS ) 3-6

18 60 4. [10,16] (Policy) (Guideline) (Standard) (Procedure) (Control)

19 61 1. (Guideline) (Guideline) (must) (should) (universal application)( ) 2. (Standard) 3. (Procedure) ( ) 4. (Control) ( )

21 63 8. (Fundamental Conceptual Models) ( ) [1] [2] 1999 [3] 2001 [4] 2001 Web [5]

22 64 [6] ( ~25 ) [7] (1), [8] / 31 / [9] BSi, Information security management Part 2: Specificatoin for information security management systems, BS7799-2:1999, BSi. [10] Cresson, C., Information Security Polices Made Easy, Version 7, Accu-Disk, [11] Eckes, G., The Six Sigma Revolution, Wiley, [12] Eloff, M.M. and Von Solms S.H., Information security Management: An Approach to Combine Process Certification and Product Evaluation, Computers and Security, 19(8), 2000, [13] ISO, Banking and Related financial services Information security guidelines, ISO/TR 13569:1997(E), ISO. [14] ISO, Information TechnologyCode of practice for information security management,iso/iec 17799:2000 (E), ISO. [15] NIST(National Institute of Standards and Technology), Security Requirements for Cryptographic Modules, FIPS (Federal Information Processing Standard)PUB (Publication) 140-2, 2001, NIST. [16] Peltier, T.R., Information Security Policies and Procedures, Auerbach, [17] Siponen, M.T., A Paradigmatic Analysis of Convention Approaches for Developing and Managing Secure IS, IFIP (International Federation for Information Processing)/Sec01, 2001,

23 65

892213E006146

892213E006146 Modular Design of Quality Control Systems NSC89-2213-E006-146 89 8 1 90 7 31 ( ) ISO14000, and OHSAS18000. Keywords: ISO9000; ISO14000; OHSAS18000; Quality ISO9000 ISO14000 OHSAS18000 Management; Environment