AHP를 이용한 정보보안 요소의 중요도 평가: 국방기관 정보시스템 외주개발 사례
Assessing the Importance of Information Security Factors Using AHP: Case of Defense Agency’s Outsourcing Development of Information Systems
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
In this paper, we identify and evaluate the information security factors considered in outsourcing development of information systems for defense agency with analytic hierarchy process(AHP). To assess the information security elements, we prepared three groups including the experts of a defense agency, subcontractor managers and subcontractor practitioners who are involved in developing information systems. And the relative importance of security factors were analyzed using questionnaires and responses. As a result of analysis of 27 security factors, factors corresponding to human and physical security as a whole were evaluated as having higher importance. Although there are some differences in the ranking of some importance according to human roles, they can be positive for the implementation of complementary information security. And administrative security and technical security can be relatively insignificant considering that they can be considered as infrastructure of the overall information environment. The result of this paper will be helpful to recognize the difference of perception of information security factors among the persons in the organization where collaboration is activated and to prepare countermeasures against them.
Abstract
In this paper, we identify and evaluate the information security factors considered in outsourcing development of information systems for defense agency with analytic hierarchy process(AHP). To assess the information security elements, we prepared three groups including the experts of a defense agency, subcontractor managers and subcontractor practitioners who are involved in developing information systems. And the relative importance of security factors were analyzed using questionnaires and responses. As a result of analysis of 27 security factors, factors corresponding to human and physical security as a whole were evaluated as having higher importance. Although there are some differences in the ranking of some importance according to human roles, they can be positive for the implementation of complementary information security. And administrative security and technical security can be relatively insignificant considering that they can be considered as infrastructure of the overall information environment. The result of this paper will be helpful to recognize the difference of perception of information security factors among the persons in the organization where collaboration is activated and to prepare countermeasures against them.
참고문헌 (23)
- 전제만, "공공기관의 정보시스템 아웃소싱에 미치는 영향 요인과 도입 성과", 한국콘텐츠학회 논문지, 13(3), pp.339~351 (2013), 한국콘텐츠학회[DOI]
- 진병욱, "퍼스널 클라우드 환경에서 사용자 관리를 위한 보안 프레임워크의 설계 및 평가", (사)디지털산업정보학회 논문지, 12(1), pp.81~87 (2016), (사)디지털산업정보학회[DOI]
- 김기훈, "사이버보안 전문인력 획득을 위한 사이버보안 훈련생에 특화된 훈련성과 측정 모델에 관한 연구", (사)디지털산업정보학회 논문지, 12(4), pp.59~69 (2016), (사)디지털산업정보학회[DOI]
- 국방부, "군사보안 업무훈령", ~ (2013)
- 국방부, "국방 사이버안보 훈령", ~ (2015)
- 국방부, "국방 정보화업무 훈령", ~ (2018)
- 김경환, "CMMI와 PMBOK의 비교 분석을 통한 정량적 프로젝트 관리", 정보처리학회논문지D, 12(4), pp.601~608 (2005), 한국정보처리학회
- 행정안정부, "행정기관 및 공공기관 정보시스템 구축.운영 지침" (2018)
- 행정안정부, "소프트웨어 개발보안 가이드" (2017)
- 행정안정부, "IT 아웃소싱 운영 관리 매뉴얼 V2.0" (2011)
- 행정안정부, "소프트웨어 보안약점 진단가이드" (2013)
- 방송통신위원회, "IT외주인력 보안통제 안내서" (2011)
- Saaty, T.L., "The Analytic Hierarchy Process" (1980), McGraw-Hill
- Saaty, T.L, "How to make decision: The Analytic Hierarchy Process", European Journal of Operational Research, 48(1), pp.9~26 (1990)[DOI]
- 정철용, "AHP기법을 활용한 정보시스템 개발 프로젝트 위험요인 평가에 관한 탐색적 연구", 정보시스템연구, 15(2), pp.77~93 (2006), 한국정보시스템학회
- 손병준, "금융회사 대형 IT프로젝트 추진 시 외주직원에 대한 보안정책 적용 사례 연구", 한국인터넷방송통신학회 논문지, 17(4), pp.193~201 (2017), 한국인터넷방송통신학회[DOI]
- 이봉규, "IT 외주용역 보안 강화 지침 개발 및 법 제화 연구", pp.56~72 (2014)
- 이은섭, "정보시스템 구축・운영을 위한 IT 외주용역기반 보안관리 강화에 관한 연구", 한국인터넷방송통신학회 논문지, 17(4), pp.27~34 (2017), 한국인터넷방송통신학회[DOI]
- 김대기, "제3자 물류업체 선정을 위한 평가항목 개발 및 우선순위 설정에 관한 연구", 경영과학, 20(2), pp.151~163 (2003), 한국경영과학회
- 장양철, "AHP를 이용한 정보시스템 개발업체 선정에 관한 연구", 한국IT서비스학회지, 5(3), pp.187~201 (2006), 한국IT서비스학회
- Metin, D., "Weapon Selection Using The AHP and TOPSIS Methods under Fuzzy Environment", Expert Systems with Applications, 36(4), pp.8143~8151 (2009)[DOI]
- 오기성, "AHP기법을 이용한 최적의 웹사이트 선정 및 품질 평가에 관한 연구", 정보처리학회논문지D, 11(2), pp.381~386 (2004), 한국정보처리학회
- Tama M.C.Y, "An Application of The AHP in Vendor Selection of A Telecommunications System", Omega, 29(2), pp.171~182 (2001)[DOI]