기밀정보 유출 경험을 가진 기업들의 정보사고 대응역량 강화에 관한 연구
The Correspondence Competence of Information Accident by Firms Experienced in Confidential Information Leak
0
조회
0
다운로드
14
인용
0
참고문헌
키워드
초록
The purpose of this study is to examine a security investment for firms experienced in confidential information leak. Information security is an apparatus for protection of secret information. The competence of information security is a competitiveness to avoid information leakage in changing business environment. The type of information security is divided into administrative security, technical security and physical security. It is necessary to improve the incident correspondence competence through information security investment of the three types. Therefore, the investment of information security is to enhance information-asset protection of firms. To reinforce accident response competence, an organization discussed an establishment, security technology development, expand investment and legal system of the security system. I have studied empirically targeting the only information leak of firms. This data is a technical security competence and technology leakage situation of firms happened in 2010. During recovery of the DDos virus damage on countries, company and individual, the collected data signify a reality of information security. The data also identify a security competence of firms worrying information security management. According to the study, the continuous investment of information security has a high competence of accident correspondence. In addition, the most of security accidents showed a copy and stealing of paper and computer files. Firm on appropriate security investment is an accident correspondence competence higher than no security investment regardless of a large, small and medium-sized, and venture firm. Furthermore, the rational security investment should choose the three security type consideration for firm size.
Abstract
The purpose of this study is to examine a security investment for firms experienced in confidential information leak. Information security is an apparatus for protection of secret information. The competence of information security is a competitiveness to avoid information leakage in changing business environment. The type of information security is divided into administrative security, technical security and physical security. It is necessary to improve the incident correspondence competence through information security investment of the three types. Therefore, the investment of information security is to enhance information-asset protection of firms. To reinforce accident response competence, an organization discussed an establishment, security technology development, expand investment and legal system of the security system. I have studied empirically targeting the only information leak of firms. This data is a technical security competence and technology leakage situation of firms happened in 2010. During recovery of the DDos virus damage on countries, company and individual, the collected data signify a reality of information security. The data also identify a security competence of firms worrying information security management. According to the study, the continuous investment of information security has a high competence of accident correspondence. In addition, the most of security accidents showed a copy and stealing of paper and computer files. Firm on appropriate security investment is an accident correspondence competence higher than no security investment regardless of a large, small and medium-sized, and venture firm. Furthermore, the rational security investment should choose the three security type consideration for firm size.
참고문헌 (33)
- 정병호, "중소기업의 IT 투자에 따른 정보품질과 프로세스 개선에 관한 연구", 중소기업연구, 36(4), pp.47~71 (2014), 한국중소기업학회
- 정병호, "소셜 미디어는 캐즘(Chasm)과 구매 가치에 얼마나 영향을 미치는가? : 채택 집단간 정보력 및 신뢰도 효과", 한국IT서비스학회지, 13(1), pp.221~251 (2014), 한국IT서비스학회[DOI]
- Nosworthy, Julie D., "Implementing Information Security In The 21 st Century—Do You Have the Balancing Factors?", Computers & security, 19(4), pp.337~347 (2000)
- Stoneburner, G., "Risk Management Guide for Information Technology Systems (Special Publication 800-30)", National Institute of Standards and Technology, ~ (2002)
- 이정환, "기업 보안 유형에 따른 보안사고 대응역량：사회기술시스템 이론 관점에서", 한국IT서비스학회지, 12(1), pp.289~308 (2013), 한국IT서비스학회[DOI]
- Kotulic, Andrew G., "Why there aren’t more information security research studies", Information & Management, 41(5), pp.597~607 (2004)
- Ifinedo Princely, "Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory", Computers & Security, 31(1), pp.83~95 (2012)
- Anderson, Evan E., "Enterprise information security strategies", Computers & Security, 27(1), pp.22~29 (2008)
- 최재영, "IT 투자 정당화 요인에 관한 연구", (사)디지털산업정보학회 논문지, 11(4), pp.177~187 (2015), (사)디지털산업정보학회[DOI]
- Mattord, Herbert, "Regulatory Compliance in Information Technology and Information Security", AMCIS 2007 Proceedings (2007)
- Merkow, Mark S, "Information security: Principles and practices" (2014), Pearson Education
- 신현조, "인적 및 직무특성과 보안교육 이수율 및 사이버테러 대응과의 연관성 분석", (사)디지털산업정보학회 논문지, 10(4), pp.97~107 (2014), (사)디지털산업정보학회
- Fred, C., "Managing network security – Part 5:Risk management or risk analysis", Network Security, 1997(4), pp.15~19 (1997)
- Clegg, Chris W., "Sociotechnical principles for system design", Applied ergonomics, 31(5), pp.463~477 (2000)
- Heller, Frank, "Socio-technology and the environment", Human Relations, 50(5), pp.605~624 (1997)
- The sociotechnology of sociotechnical systems: Elements of a theory of plans, "Seni, Dan Alexander", Studies on Mario Bunge’s Treatise, 431~454 (1990)
- “The evolution of socio-technical systems,” a conceptual framework and an action research program, "Trist, E.", ~ (1981)
- Guo, Ken H., "Security-related behavior in using information systems in the workplace: A review and synthesis", Computers & Security, 32, pp.242~251 (2013)
- Yeh, Quey-Jen, "Threats and countermeasures for information system security: A cross-industry study", Information & Management, 44(5), pp.480~491 (2007)
- Vacca, John R., "Computer and information security handboo", Newnes, ~ (2012)
- NIST, "Information Security Handbook: A Guide for Managers", ~ (2006)
- Pugh, Derek S., "Writers on organizations" (2007), Penguin UK
- Baskerville, Richard, "An information security meta-policy for emergent organizations", Logistics Information Management, 15.5(6), pp.337~346 (2002)
- Hsu, Jack Shih-Chieh, "The Role of Extra-Role Behaviors and Social Controls in Information Security Policy Effectiveness", Information Systems Research, 26(2), pp.282~300 (2015)
- Von Solms, Basie, "Corporate governance and information security", Computers & Security, 20(3), pp.215~218 (2001)
- Hu, Qing, "Managing employee compliance with information security policies:the critical role of top management and organizational culture", Decision Sciences, 43(4), pp.615~660 (2012)
- Ifinedo, Princely, "Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition", Information & Management, 51(1), pp.69~79 (2014)
- Post, Gerald, "Management tradeoffs in anti-virus strategies", Information &Management, 37(1), pp.13~24 (2000)
- Whitman, Michael, "Management of information security", Nelson Education, ~ (2013)
- 중소기업청, "보안 컨설턴트용 실무가이드북", 중소기업기술정보진흥원, ~ (2007)
- Vance, Anthony, "Motivating IS security compliance:insights from habit and protection motivation theory", Information & Management, 49(3), pp.190~198 (2012)
- 정병호, "IT 프로젝트 모방 투자 유형에 따른 성과 차이 연구", 한국IT서비스학회지, 11(3), pp.205~225 (2012), 한국IT서비스학회
- Hair, Joseph F., "Multivariate data analysis" (2010)