정보보호 성숙도와 조직성과 간의 정보보호 정책의 효과분석
The Moderating Effects of Information Security Policy between Information Security Maturity and Organizational Performance
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
정보의 가용성, 접근성, 안전성을 확보하기 위한 선제적인 정보보호 관리의 부재는 서비스 연속성을 훼손하여 고객에게 뿐만 아니라 조직의성과와 경쟁력에 심각한 리스크를 가져다 줄 수 있다. 본 연구는 정보보호 성숙도가 조직성과에 미치는 영향을 분석하기 위하여 문헌 조사를통해 조직성과, 위험 관리 프로세스 성숙도, 위험 평가 프로세스 성숙도, 정보보호 정책지표를 포함하는 연구모형을 만들고 설문을 통한 실증분석을 하였다. 연구결과 위험 관리 및 위험 평가의 프로세스 성숙도와 조직성과 간에는 높은 인과 관계가 있는 것으로 나타났다. 하지만 정보보호 인력비율, 정보보호 예산비율에 따라 정보보호 성숙도가 조직성과에 미치는 영향은 차이가 없는 것으로 나타났다. 이는 정보보호 성숙도 수준은 조직성과에 영향을 미치나, 실효성이 검증되지 않은 정보보호 정책 및 규제는 정보보호 성숙도가 조직의 성과 향상의 촉매제로 활용하는데 한계가있음을 시사하고 있다.
Abstract
The absence of proactive information security management to ensure availability, accessibility and safety of information can bringserious risks to customers as well as to the organization’s performance and competitiveness because improper security managementundermines business continuity. This study analyzed the maturity of information security which affects the organizational performance. Through the literature reviews, a research model using the organizational performance as the dependent variable, the risk managementprocess maturity and risk assessment process as independent variables and the information security policy indexes as moderate variableswas proposed, and an empirical analysis was made on the basis of survey. The results showed that there was a high causal relationship between information security maturity and organizational performance. However, even if the proportions of information security staff ratio and the information security budget ratio increased, informationsecurity maturity did not affect organizational performance. It suggests that information security maturity affects organizationalperformance, but information security regulations have their limitation as being a catalyst to improve organizational performance.
참고문헌 (30)
- Suhazimah Dzazali, "Assessment of information security maturity: An exploration study of Malaysian public service organizations", Journal of Systems and Information Technology, 14(1), pp.23~57 (2013)
- ISO, "IEC", Information Technology-Security Techniques-Information Security Management Systems-Requirements, 2005
- M. Simonsson, "The effect of IT governance maturity on IT governance performance", Information Systems Management, 27, pp.10~24 (2010)
- NIST, "Managing Information Security Risk:Organization, Mission and Information System View", ~ (2011)
- ISO, "IEC", Information technology -Guidelines for the management of IT Security- Part 2 : Managing and planning IT Security, 1997
- NIST, "Guide for Conducting Risk Assessment", ~ (2012)
- ENISA(European Network and Information Security Agency), "Regulation No 460", 2004 of the european parliament and of the council, 2004
- OCTAVE, "Method Implementation Guide Version 2. 0", Carnegie Mellon University, ~ (2001)
- J. H. Hall, "Impacts of organizational capabilities in information security", Information Management & Computer Security, 19(3), pp.155~176 (2011)
- R. Baskerville, "Designing Information System Security" (1998), Wiley
- B. Schneier, "Secret and Lies-Digital Security in a Networked World" (2002), Wiley Computer Publishing
- K. N. Bhaskar, "Computer Security: Threat and Countermeasures" (1993), NCC-Blackwell
- M. B. Chrissis, "CMMI- Guidelines for Process Integration and Product Improvement" (2005), SEI
- IT Governance Institute (ITGI), "Cobit 4.1", ITGI, ~ (2007)
- Project Management Institute(PMI), "PMI Fact Sheet" (2006), PMI
- Project Management Institute(PMI), "A guide to the project management body of knowledge(PMBOK Guide)", ~ (2000)
- J. M. Hagen, "Implementation and effectiveness of organizational information security measures", Information Management & Computer Security, 16(4), pp.377~397 (2008)
- S. Smith, "A financial Management Approach for Selecting Optimal, Cost-Effective Safeguards Upgrades for Computer and Information Security Risk Management", Computer and Security, 14(1), pp.28~29 (1995)
- M. J. Baek, "A Study on information security awareness and behavior affecting information security effectiveness in smaller member organization", Small Business Research, 33(2), pp.113~132 (2011)
- K. K. Kim, "A Study on impact information assets protection accomplish affecting organizational performance", Information Management Research, 40(3), pp.61~77 (2009)
- G. H. Hong, "A Study on Impact on Information Security control and activities affecting information security performance", 박사, Information management department, pp.2003
- Korea Financial Telecommunications & Clearings Institute, "The financial IT and information security trend prediction", Payment and information technology, (55), pp.90~126 (2014)
- Financial Supervisory Commission, "Electronic financial supervisory regulation", ~ (2014)
- Financial Supervisory Commission, "The financial institutions information technology security duties standard", ~ (2012)
- B. B. Yeol, "Structural equation model for understanding and use" (2006), Publishing Daegyeong
- X. Koufteros, "Product development Practices and performance: A structural equation modelingbased multi-group analysis", International Journal of Production Economics, pp.286~307 (2006)
- C. Fornell, "Evaluating structural equation models with unobservable variables and measurement error", Journal of Marketing Research, pp.39~50 (1981)