정보보호 위원회 활동에 따른 정보보호 거버넌스 구현 효과에 관한 연구
A study on effects of implementing information security governance by information security committee activities
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
정보보호 거버넌스의 주체는 최고경영층이지만 여전히 정보보호 활동에 대한 최고경영층의 참여는 미흡한 실정이다. 이러한 상황에서 정보보호 위원회는 최고경영층의 정보보호 활동 참여를 활성화 하는데 좋은 방법이 될 수 있으며, 결국 정보보호 위원회 활동은 정보보호 거버넌스 구현을 위한 필수 요소라 할 수 있다. 본 연구의 목적은 정보보호 위원회의 활동이 정보보호 거버넌스 구현과 보안효과에 미치는 영향을 확인하는 것이며, 실증연구 분석을 위해설문조사를 실시하였고, 수집된 자료는 PLS(Partial Least Square)를 이용하여 측정모형 및 구조모형 검정을실시하였다. 연구 결과, 가치전달과 관련된 가설이 기각되었으며, 향후 정보보호가 비즈니스에 긍정적인 가치를 전달할 수 있는 방안에 대한 연구가 필요하다.
Abstract
The commitment of top management is still insufficient for information security even the core of information security governance is dependent on the leadership of top management. In this situation, information security committee can be a good way to vitalize the commitment of top management and its activities are essential for implementing information security governance. The purpose of this study is to test that information security committee affects implementing information security governance and security effect. For a empirical analysis, questionnaire survey was conducted and the PLS(Partial Least Square) was used to analyze the measurement and structural model. The study result shows that a hypothesis related value delivery is not accepted and it is required to study various methods about how the information security provides positive value to business.
참고문헌 (17)
- CERT resilience management model version 1.0, "Richard A. Caralli", Carnegie Mellon University, ~, pp.Technical Report, CMU (2010), SEI – 2010 – TR - 012
- Todd Fitzgerald, "Building management commitment through security councils", Information Systems Security, 14(2), pp.27~36 (2015)
- Tom Scholtz, "Information security and governance : forums and committees", G00207477, ~ (2010)
- ISO, "IEC", Governance of information security, 2013
- Shaun Posthumus, "A framework for the governance of information security", Computers and Security, 23(8), pp.638~646 (2004)
- Paul Williams, "Information security governance", Information Security Technical Report, 6(3), pp.60~70 (2001)
- Basie von Solms, "Information security governance : compliance management vs operational management", Computers &Security, 24(6), pp.443~447 (2005)
- Corporate Governance Task Force, "Information security governance: a call to action", ~ (2004)
- Integrating IT security into the capital planning and investment control process, "Joan Hash", National Institute of Standards and Technology, ~, pp.Special Publication 800-65 (2005)
- Rossouw von Solms, "Information security governance : a model based on the direct–control cycle", Computers & Security, 25(6), pp.408~412 (2006)
- Rolf Moulton, "Applying information security governance", Computers & Security, 22(7), pp.580~584 (2003)
- Richard M. Steinberg, "Enterprise risk management : integrated framework" (2004), COSO
- W. Krag Brotby, "Information security governance guidance for boards of directors and executive management", IT Governance Institute, ~ (2006)
- Jacqueline H. Hall, "Impacts of organizational capabilities in information security", Information Management &Computer Security, 19(3), pp.155~176 (2011)
- Chin W. W., "Modern Methods for Business Research", pp.295~336 (1998), Lawrence Erlbaum Associates
- Claes Fornell, "Evaluating structural equation models with unobservable variables and measurement error", Journal of Marketing Research, 18(1), pp.39~50 (1981)
- Falk R. F., "A Primer for Soft Modeling" (1992), The University of Akron Press