정보보호의 투자 집행 효과에 관한 연구
Studies on the effect of information security investment executive
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
본 논문에서는 정보보호 관리체계를 구축하고 운영하고 있는 기업에서 외부감사(ISO27001)와 내부감사(보안전담조직에 의한)에 대한 결함 및 권고사항을 기술적 영역, 관리적 영역, 물리적 영역으로 분류하고 예산과 투자에 대한 상관관계를 확인하여 어떠한 영향이 있는지 분석하였다. 분석 결과는 시간의 흐름에 따라 관리적 보안영역과 기술적 보안영역에서 일관성 있는 연관관계를 확인하였으며 특히 미집행 예산(예산액-집행액) 규모와 감사 결함 및 권고사항의 수가 정(+)의 관계에 있음을 확인할 수 있었다. 이를 통해 상관분석 결과에 따른 유사도를 통계 분석하여 정보보호 투자의 효과성을 검증할 수 있는 모델을 제시한다. 그리하여 기업의 정보보호 투자에 대한 체계적인 방법론 접근과 정보보호 정책 수립 시 정확한 의사결정 방향에 도움이 되고자 한다.
Abstract
This paper classifies technical, administrative and physical areas of defects and advices made by an external audit (ISO27001)and internal audit (performed by a security team) in a company which has the management system of information security. Withthe classified data it finds the correlation between the budget and investment of information security, and analyze the correlation. As a result of the analysis, it has been found that as time goes on there is a consistent correlation between a administrative areaand technical area of security. Specially, it has been confirmed that the relation between the scale of the budget which is notexecuted and the number of the defects and advices made by the audit is in direct proportion. Therefore, in this paper, so asto provide a model that can be used for validating the effectiveness of the protective investment information by statisticallycalculating the similarity based on the results of correlation analysis. This research is intended to help that a company makesa precise decision when it establishes a policy of information security and systematic methodology of the investment ininformation security.
참고문헌 (25)
- "Hankyoreh News" (2014)[URL]
- 2014 National Information Security White Paper, "KISA", ~ (2014)
- Information Security industrial development agenda of comprehensive plan, "Ministry of Science", ICT, ~ (2013)
- Information Security Survey 2013, "KISA", ~ (2013)
- Roper, C.A., "Risk Management for Security Professionals", pp.83~96 (1999), Butterworth-Heinemann
- Blakley, B., "Returns on Security Investment: an Imprecise but Necessary Calculation", Secure Business Quarterly, 1(2) (2001)
- Harris, S., "CISSP All-in-One Exam Guide" (2001), McGraw-Hill
- Jeong-deok Kim, "Based on information security ROI TCO(ROSI)study", The Society of Digital Policy & Management, Founding Conference, pp.251~261 (2003)
- Jong-seon Lee, "Using the TCO-based Security ROI information security investment performance and evaluation method", Korea Information Processing Society, Conference, pp.1125~1128 (2007)
- Study on Improving the information protection level by Integrated Evaluation Items(IEI), "Young-Tek Jo", 53~63 (2004)
- Witty R. J, "The Price of Information Security" (2001), Gartner Inc.
- Gordon, L.A., "The Economics of Information Security Investment", ACM Transactions on Information and System Security, 5(4), pp.438~457 (2002)
- Cavusoglu, H., "Economics of IT Security Management:Four Improvements to Current Security Practices", Communications of the Association for Information System, 14, pp.65~75 (2004)
- Cavusoglu, H., "A Model for Evaluating IT Security Investments", Communications of the ACM, 47(7), pp.87~92 (2004)
- Study on the Differences of Priority between Information Protection Importance and Security Investment, "Jin Kim", 34~43 (2014)
- Factors that Affect Selection of Information Security Countermeasures, "Chul-hwan Jang", 28~30 (2014)
- Scott, D., "Security Investment Justification and Success Factors" (1998), Gartner Inc.
- Leem, C.S., "Introduction to an Integrated Methodology for Development and Implementation of Enterprise Information Systems", Journal of Systems and Software, 60(3), pp.249~261 (2002)
- Davis, A., "Return on Security Investment-Proving It's Worth It", Network Security, 2, pp.8~10 (2005)
- Han-kil Seon, "Study on the effect of information security policy and organization on the performance of information security", Korea Institute of Information Management, Conference, pp.1087~1095 (2005)
- Blatchford, C., "Information Security Controls-Are They Cost-effective", Computer Audit Journal, 3, pp.11~19 (1995)
- Ki-hyang Hong, "Study on the Effect of Information Security Controls and Processes on the Performance of Information Security", 박사, pp.2004
- Sang-hoon Nam, "Empirical Study on the Impact of Security events to the Stock Price in the Analysis method of Enterprise Security Investment Effect", 박사, pp.2006
- Young-ok Kwon, "The Effect of Information Security Breach and Security Investment Announcement on the Market Value of Korean Firms", 석사, pp.2005
- 권영옥, "정보보안 사고와 사고방지 관련 투자가 기업가치에 미치는 영향", Information Systems Review, 9(1), pp.105~120 (2007), 한국경영정보학회