Organization Information Security Policy from the Perspective of Risk Management Theory

• Main Authors: Chou,Chien-chih, 周建志
• Other Authors: Chen Ping Hsueng
• Format: Others
• Language: zh-TW
• Published: 2010
• Online Access: http://ndltd.ncl.edu.tw/handle/15305562405525699332

碩士 === 國防大學 === 戰略研究所 === 98 === Abstract This study is discussing information security policy from the perspective of risk management in three different organizations: government, private institute/enterprise cooperation and education institutions. Particularly in the rapid development of Internet technology has become increasingly rampant and malicious attacks on today. The risk management can clarify that the different organizations use different way to protect their own information system with different security policy. Also they can get rid of the myth of information security protection goal. Each organization has his own information security targets. Through risk management ,when each unit executed his own information security policy, you can find that the risk management analysis may provide the unit to carry on the value judgment standard to each unit. Different unit will make a decision with his own standard. Also this analysis can provide risk value to organizations through the risk-judgment, to take units’ different risk strategies. By way to the different organization information security's risk management analysis, may provide the researcher to carry on to the information security contemplation. And the researcher can get the reference when he engages any project or planning goal. According to risk management analysis points out that the information security work is impossible to achieve "zero risk" situation. Through this study found that, despite the different organizations face different IT security challenges, only all of the organization, the staff from top to bottom, work together , and have the same information security understanding. The unit can develop the best information security risk management strategy. Key Word: Information Security, Risk Management, Government Agency, Enterprise, Education System