기업의 내부 인력 보안을 위한 IT 외주 용역 특성 분석

Abstract

As many enterprises implement an information system to manage their business, IT outsourcing that operates and manages the system is increasing. Information systems can integrate all business resources and manage business processes, which enables the outsourced employees to obtain critical information about enterprise business. Actually, a large portion of security incidents regarding information leakage of enterprises are being caused by IT outsourcing. However, there is a lack of guidelines that can be used to establish security measures for the outsourcing, because domestic and foreign information security management systems (ISMS) do not specify various types of IT outsourcing even though they provide security requirements for organizations. In this paper, we classify various types of IT outsourcing and define their characteristics considering information system’s architecture, such as the status of network isolation, IT resource type, employees’ location and their access authorization.