산업별 정보보안의 투자 수준과 관리 역량에 관한 연구
A Study on the Investment Level and Administrative Competence of Information Security by Industry
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
The purpose of this study is to examine what are the important variables for information security compliance and whether the information security investment by the industry is different. To comply with the information security policies, the organization must establish measures to prevent or resolve information security incidents. This research process consists of four stages, and the analysis method was conducted with the categorical regression analysis and the correspondence analysis. The first analysis analyzed the independent variables that affect security regulations compliance. The rest of the analysis was conducted by industry in the order of security compliance regulations, manpower investment, and budget investment. As a result of the first analysis, this had positive effects on an organization and personal information protection awareness, joint operation organization of information protection, manpower and budget investment, corporate size, and industry. The correspondence analysis was conducted from the second analysis to the fourth analysis and it analyzed the differences in information security investment by industry. The second analysis showed that the construction industry, science and technology industry, and finance industry have higher compliance with security regulations than other industries. The third analysis showed that the financial industry and the science and technology industry were higher than other industries. The last analysis showed that the financial industry was higher than other industries. The theoretical contribution of this study provided the basis for updating the information security theory. The practical contribution of this study requires government support to reduce information security deviations by industry.
Abstract
The purpose of this study is to examine what are the important variables for information security compliance and whether the information security investment by the industry is different. To comply with the information security policies, the organization must establish measures to prevent or resolve information security incidents. This research process consists of four stages, and the analysis method was conducted with the categorical regression analysis and the correspondence analysis. The first analysis analyzed the independent variables that affect security regulations compliance. The rest of the analysis was conducted by industry in the order of security compliance regulations, manpower investment, and budget investment. As a result of the first analysis, this had positive effects on an organization and personal information protection awareness, joint operation organization of information protection, manpower and budget investment, corporate size, and industry. The correspondence analysis was conducted from the second analysis to the fourth analysis and it analyzed the differences in information security investment by industry. The second analysis showed that the construction industry, science and technology industry, and finance industry have higher compliance with security regulations than other industries. The third analysis showed that the financial industry and the science and technology industry were higher than other industries. The last analysis showed that the financial industry was higher than other industries. The theoretical contribution of this study provided the basis for updating the information security theory. The practical contribution of this study requires government support to reduce information security deviations by industry.
참고문헌 (26)
- "기술 경쟁 치열한데 또…삼성전자, '핵심자료 유출' 직원 해고" (2023), 연합뉴스[URL]
- "내부고발자 "테슬라, 개인정보 보호안 해"" (2023), 한국경제TV[URL]
- ""삼성전자, 직원들 챗GPT 사용 금지"…회사정보 유출 차단" (2023), 머니투데이[URL]
- 정병호, "비윤리적 정보공유 딜레마와 사회적 네트워킹 관계에서 정보접근 모니터링의 영향력", (사)디지털산업정보학회 논문지, 14(2), pp.91~105 (2018), (사)디지털산업정보학회[DOI]
- 정병호, "기밀정보 유출 경험을 가진 기업들의 정보사고 대응역량 강화에 관한 연구", (사)디지털산업정보학회 논문지, 12(2), pp.73~86 (2016), (사)디지털산업정보학회[DOI]
- 이정환, "기업 보안 유형에 따른 보안사고 대응역량：사회기술시스템 이론 관점에서", 한국IT서비스학회지, 12(1), pp.289~308 (2013), 한국IT서비스학회[DOI]
- 정병호, "윤리 프로그램을 통한 비윤리적 정보공유 행동의 개선: 사회적 자본과 잔물결 효과", 디지털융복합연구, 15(8), pp.169~182 (2017), 한국디지털정책학회[DOI]
- NIST, "Information Security Handbook: A Guide for Managers", ~ (2006)
- Merkow, Mark S, "Information security: Principles and practices" (2014), Pearson Education
- Mattord, Herbert, "Regulatory Compliance in Information Technology and Information Security", AMCIS 2007 Proceedings (2007)
- "산업기술의 유출방지 및 보호에 관한 법률(약칭:산업기술보호법)" (2023), 산업기술의유출방지및보호에관한법률[URL]
- "산업기밀보호센터"[URL]
- Baskerville, Richard, "An information security meta-policy for emergent organizations", Logistics Information Management, 15(6), pp.337~346 (2002)
- Solms, B., "Information Security Management:The Second Generation", Computer and Security, 15(4), pp.281~288 (1996)
- Hone, K., "Information Security Policy: What do International Information Security Standards Say?", Computers and Security, 21(5), pp.402~409 (2002)
- Anderson, Evan E., "Enterprise information security strategies", Computers & Security, 27(1), pp.22~29 (2008)
- Hu, Qing, "Managing employee compliance with information security policies:the critical role of top management and organizational culture", Decision Sciences, 43(4), pp.615~660 (2012)
- Bulgurcu, B., "Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness", MIS quarterly, 34(3), pp.523~548 (2010)
- Hovav, A., "Applying an extended model of deterrence across cultures: An investigation of information systems misuse in the US and South Korea", Information &Management, 49(2), pp.99~110 (2012)
- Siponen, M., "Neutralization: New insights into the problem of employee information systems security policy violations", MIS quarterly, 34(3), pp.487~502 (2010)
- 황인호, "개인의 대처 유형과 조직문화가 조직원의 정보보안에 미치는 영향", 한국산업정보학회논문지, 26(2), pp.27~41 (2021), 한국산업정보학회
- "2021년 정보보호 실태조사(기업)", 과학기술정보통신부[URL]
- 양경숙, "SPSS를 이용한 최적 범주형 자료분석" (2004), 한나래아카데미
- Hair, Joseph F, "Multivariate data analysis", ~ (2010)
- 노형진, "SPSS에 의한 다변량 데이터의 통계분석" (2007), 효산출판사
- "전자금융감독규정"[URL]