정보보안 투자가 침해사고에 미치는 영향에 대한 실증분석: 정보보안 교육 서비스 투자를 중심으로
An Empirical Study of Relationship between Information Security Investment and Information Security Incidents : A Focus on Information Security Training, Awareness and Education Service Sector
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
정보화 사회에서 핵심 가치로 평가받고 있는 자원은 정보 그 자체이다. 이런 이유로 기업의 가치 있는 정보를 노리는 시도가 많아지며 정보보안 사고가 급증하고 있다. 기업에서는 정보보안 사고를 예방하기 위해 다양한 정보보안부문에 투자하고 있으나, 어떤 부문에 대한 투자가 정보보안 사고를 감소시키는 데에 직접적으로 기여하는지는 잘알지 못한 채 투자하고 있다. 기업의 대표적인 정보보안 투자 부문인 제품뿐만 아니라 대표적인 정보보안 서비스 사업으로 각광받고 있는 정보보안 교육 및 훈련, 보안관제 서비스, 그리고 취약점 분석의 투자 효용을 알아보기 위해본 연구를 진행하였다. 한국 인터넷 진흥원의 2014년 정보보호 실태 조사의 원자료를 이용하고, 총 정보보안 사고건수를 종속변수로 두고 음이항분포 회귀분석을 실시한 결과 교육 서비스와 취약점 분석 서비스가 정보보안 사고를줄이는 데에 유의미하게 기여하는 것으로 판단되었다. 이 연구는 학문적으로는 정보보안 경제학을 이론적 배경으로하여 정보보안 투자 부문의 실제 효용을 파악한 연구이며, 실증적으로는 조직에서 한정된 자원을 정보보안 투자에배분할 때 효율적인 의사결정을 하는 데에 지침을 제공할 수 있는 연구이다.
Abstract
Many organizations are threatened by numerous information security attacks which are resulting in information securityincidents. To prevent information security incidents, organizations invest on various information security measures likeinformation security products, monitoring services and security training and educations. However they do not have enoughknowledge about measurable utilities of information security investments. Since there is little studies empirically examiningthe effect of information security investments, this research aims to find out utilities of information security investment. Weespecially focuse on information security service investments. This study examined the data from the survey on informationsecurity for business sector which was conducted by Korean information & security agency. We utilized negative binomialregression model, which is a suitable model for over-dispersed count data. We found out that an investment on informationsecurity education and vulnerability testing have direct impact on reducing information security incidents. This researchacademically contributed to shed light on the utility of information security investments on reducing information security incidents. This research practically contributed to providing information security investment guideline for organizations whichwant to reduce information security incidents efficiently.
참고문헌 (40)
- Jung-Ho Lee, ""Firms' "Ransomware accidents has increased 11 times, Hankyung health", ~ (2017)
- Yu-ji Lee, "The size of information security incidents damage is increaing- Top managements' strong support and insurance subscription help firms to reduce damage amount, Digital daily", ~ (2015)
- Seung-pil Choi, "Information society and its enemy, Korea times", ~ (2017)
- PwC, "Turnaround and transformation in cybersecurity: Retail and consumer" (2016)
- K.Campbell, "The economic cost of publicly announced information security breaches: empirical evidence from the stock market", Journal of Computer Security, 11(3), pp.431~448 (2003)[DOI]
- Tae-Hyung Kim, "Information security budget management(2) - 5 factors tha t firms must consider to invest on inf ormation security, Boan news", ~ (2015)
- L. A. Gordon, "The economics of information security investment", ACM Transactions on Information and System Security (TISSEC), 5(4), pp.438~457 (2002)[DOI]
- K. Hausken, "Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability", Information Systems Frontiers, 8(5), pp.338~349 (2006)
- C. D. Huang, "An economic analysis of the optimal information security investment in the case of a risk-averse firm", International Journal of Production Economics, 114(2), pp.793~804 (2008)[DOI]
- L. A. Gordon, "Externalities and the magnitude of cyber security underinvestment by private sector firms: a modification of the Gordon-Loeb model", Journal of Information Security, 6(1), pp.24~30 (2015)[DOI]
- 권영옥, "정보보안 사고와 사고방지 관련 투자가 기업가치에 미치는 영향", 경영정보학연구, 9(1), pp.105~120 (2007), 한국경영정보학회
- Anat Zeelim-Hovav, "정보보안 사고가 기업의 주식가치에 미치는 영향 : 한국기업 중심으로", 인터넷전자상거래연구, 13(3), pp.43~67 (2013), 한국인터넷전자상거래학회
- 홍일유, "정보보안 사고에 대한 공시가 시장에서 기업의 주식가치에 미치는 영향", Entrue Journal of Information Technology, 14(2), pp.33~56 (2015), 엘지씨엔에스
- S. Chai, "Firms' information security investment decisions: Stock market evidence of investors' behavior", Decision Support Systems, 50(4), pp.651~661 (2011)[DOI]
- 공희경, "AHP를 이용한 정보보호투자 의사결정에 대한 연구", Journal of Information Technology Applications & Management, 15(1), pp.139~152 (2008), 한국데이터전략학회
- 양원석, "확률모형을 이용한 정보보호 투자 포트폴리오 분석", 한국경영과학회지, 34(3), pp.155~163 (2009), 한국경영과학회
- Korea Internet, "Survey for Information Security Industry in Korea, Korea Internet & security agency", pp.1~345 (2014)
- Se-ah Min, "Korean information securi ty market has growing - its total size is expected to grow 3,844.9 billion won until 2020, Boan news", ~ (2017)
- Hangbae Chang, "Industrial information security management" (2013), Beobmoonsa
- Seongmong Lee, "Information systems security" (2013)
- M. E. Thomson, "Information Security Awareness: Educating Your Users Effectively", Information Management & Computer Security, 6(4), pp.167~173 (1998)[DOI]
- J. D'Arcy, "User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach", Information Systems Research, 20(1), pp.79~98 (2009)[DOI]
- M. Siponen, "Compliance with information security policies: An empirical investigation", Computer, 43(2) (2010)
- Jung-Ae Kim, "Vulnerabilities found to be target of cyber war make information security professionals be nervous, Boan news", ~ (2017)
- Jung-Ho Eom, "introduction of cyber warfare : attack and security techniques" (2012)
- Hye-Kwon Shin, "Information security incidents prevention : Finding vulner abilities is important, ET news", ~ (2013)
- Sungjin Ahn, "Security monitoring and control" (2014)
- Samsung SDS, "Samsung SDS consulting - Information security monitoring and level diagnosis" (2016)
- Deloitte Anjin, "Risk management in Financial industry : Focusing on protection of information asset" (2014)
- Deloitte Anjin, "Cyber risk assessment" (2016)
- Department for Business, "2015 Information Security Breaches Survey" (2015)
- M. Creel, "Theoretical and empirical advantages of truncated count data estimators for analysis of deer hunting in California", American Journal of Agricultural Economics, 72, pp.434~441 (1990)[DOI]
- D.R. Cox, "Some remarks on overdispersion", Biometrika, 70, pp.269~274 (1983)[DOI]
- Kwan-kyu Park, "If there is another in formation security breach, it will dest roy our organization : organizations are now improving their information s ecurity, Korea times", ~ (2014)
- 최명길, "정보보호정책의 성숙도에 영향을 미치는 요인에 관한 연구", 정보보호학회논문지, 18(3), pp.131~142 (2008), 한국정보보호학회
- 김종기, "보안정책, 보안의식, 개인적 특성이 패스워드 보안효과에 미치는 영향", 정보보호학회논문지, 18(4), pp.123~134 (2008), 한국정보보호학회
- 최동근, "정보보호담당자의 역할이조직의 정보보호수준에 미치는 영향", 정보보호학회논문지, 25(1), pp.197~209 (2015), 한국정보보호학회[DOI]
- Whitman, M. E., "Enemy at the Gate: Threats to Information Security", Communications of the ACM, 46(8), pp.91~95 (2003)
- M. Wilson, "Building an Information Technology Security Awareness and Training Program, NIST Special Publication (800)", 50~ (2003)
- B. Bulgurcu, "Information Security Policy Compliance: An Empirical Study of Rationality-Based Beliefs and Information Security Awareness", MIS Quarterly, 34(3), pp.523~548 (2010)[DOI]