본문 바로가기
KERD
논문KCI 등재

정보보호 관점의 기업 유형 분류 프레임워크 개발에 관한 연구

Study on Development of Framework of Company Classification in Information Security Perspective

백동현|김희올
한국산업경영시스템학회 (KOREAN SOCIETY OF INDUSTRIAL AND SYSTEMS ENGINEERING)|2016.09|한국산업경영시스템학회지 (Journal of Korean Society of Industrial and Systems Engineering)|제39권 제3호|pp. 18-29

1

조회

0

다운로드

1

인용

0

참고문헌

키워드

Evaluation IndexInformation SecurityDevelopment of FrameworkCompany Classification
주제분류산업공학

초록

For most organizations, a security infrastructure to protect company’s core information and their technology is becoming increasingly important. So various approaches to information security have been made but many security accidents are still taking place. In fact, for many Korean companies, information security is perceived as an expense, not an asset. In order to change this perception, it is very important to recognize the need for information security and to find a rational approach for information security. The purpose of this study is to present a framework for information security strategies of companies. The framework classifies companies into eight types so company can receive help in making decisions for the development of information security strategy depending on the type of company it belongs to. To develope measures to classify the types of companies, 12 information security professionals have done brainstorming, and based on previous studies, among the factors that have been demonstrated to be able to influence the information security of the enterprise, three factors have been selected. Delphi method was applied to 29 security experts in order to determine sub items for each factor, and then final items for evaluation was determined by verifying the content validity and reliability of the components through the SPSS analysis. Then, this study identified characteristics of each type of eight companies from a security perspective by utilizing the developed sub items, and summarized what kind of actual security accidents happened in the past.

Abstract

For most organizations, a security infrastructure to protect company’s core information and their technology is becoming increasingly important. So various approaches to information security have been made but many security accidents are still taking place. In fact, for many Korean companies, information security is perceived as an expense, not an asset. In order to change this perception, it is very important to recognize the need for information security and to find a rational approach for information security. The purpose of this study is to present a framework for information security strategies of companies. The framework classifies companies into eight types so company can receive help in making decisions for the development of information security strategy depending on the type of company it belongs to. To develope measures to classify the types of companies, 12 information security professionals have done brainstorming, and based on previous studies, among the factors that have been demonstrated to be able to influence the information security of the enterprise, three factors have been selected. Delphi method was applied to 29 security experts in order to determine sub items for each factor, and then final items for evaluation was determined by verifying the content validity and reliability of the components through the SPSS analysis. Then, this study identified characteristics of each type of eight companies from a security perspective by utilizing the developed sub items, and summarized what kind of actual security accidents happened in the past.

참고문헌 (44)

  1. Bharadwaj, A., "Effects of information technology failures on the market value of firms", The Journal of Strategic Information Systems, 18(2), pp.66~79 (2009)
  2. Brancheau, J. C., "Key Issues in Information Systems Management : 1994-95 SIM Delphi Results", MIS Quarterly, 20(2), pp.225~242 (1996)
  3. ISO 17799, "Implementing Information Security Based on ISO 27001", pp.2006, Calder, A.
  4. 장항배, "중소기업 산업기술 유출방지를 위한 정보보호 관리체계 설계", 멀티미디어학회논문지, 13(1), pp.111~121 (2010), 한국멀티미디어학회
  5. Doherty, N. F., "Do Information Security Policies Reduce the Incidence of Security Breaches : An Exploratory Analysis", Information Resources Management Journal, 4, pp.21~38 (2005)
  6. Dzazali, S., "Assessment of Information Security Maturity : an Exploration Study of Malaysian Public Service Organizations", Journal of Systems and Information Technology, 14(1), pp.23~57 (2012)
  7. Ettredge, M., "Information Transfer among Internet Firms : the Case of Hacker Attacks", Journal of Information Systems, 17(2), pp.71~82 (2003)
  8. Flint, D. J., "Exploring the Phenomenon of Customers Desired Value Change in a Business to Business Context", Journal of Marketing, 66(4), pp.102~117 (2002)
  9. Least Effort Strategies for Cybersecurity, The Critical Infrastructure Project Workshop I : Working Papers, "Gorman", 1~14 (2003)
  10. Hagen, J. M., "Implementation and Effectiveness of Organizational Information Security Measures", Information Management and Computer Security, 16(4), pp.377~397 (2008)
  11. Hawkins, S., "Awareness and Challenges of Internet Security", Information Management and Computer Security, 8(3), pp.131~143 (2000)
  12. Hu, Q., "The Role of External and Internal Influences on Information Systems Security Practices : An Institutional Perspective", The Journal of Strategic Information Systems Archive, 16(2), pp.153~172 (2006)
  13. "Introduction to privacy and personal information management framework", Financial Security Institute, ~ (2011)
  14. Kankanhalli, "An Integrative Study of Information Systems Security Effectiveness", Journal of Information Management, 23(2), pp.139~154 (2003)
  15. Karyda, M., "Information security policies : a contextual perspective", Computers and Security, pp.246~260 (2005)
  16. Kast, F. E., "General Systems Theory :Applications for Organization and Management", Academy of Management Journal, 15(4), pp.447~465 (1972)
  17. Katz, D., "The Social Psychology of Organizations" (1978), Wiley
  18. 김종기, "정보보안정책, 보안통제 및 사용자특성이 정보보안효과에 미치는 영향: 컴퓨터 바이러스를 중심으로", 정보시스템연구, 15(1), pp.145~168 (2006), 한국정보시스템학회
  19. 김희올, "기업 정보보안 전략 수립을 위한 보안 사고 유형 분류에 관한 연구", 산업경영시스템학회지, 38(4), pp.193~201 (2015), 한국산업경영시스템학회
  20. 김문선, "산업보안 역량 수준평가 및 개선방안", 품질경영학회지, 41(4), pp.649~658 (2013), 한국품질경영학회[DOI]
  21. Korea Communications Commission Report, A Fact-Finding on Leak Out of Personal Data, , KCC, ~ (2015)
  22. Lohmeyer, D. F., "Managing Information Security", The McKinsey Quarterly, Special Edition : Risk and Resilience, 2, pp.12~16 (2002)
  23. Mckelvey, B., "Populations, Natural Selection, and Applied Organizational Science", Administrative Science Quarterly, 28(1), pp.101~128 (1983)
  24. Miller, P., "Strategic Industrial Relations and Human Resource Management-Distiction, Definition and Recognition", Journal of Management Studies, 24(4), pp.347~361 (1987)
  25. Mintzberg, H., "The design school : Reconsidering the basic premises of strategic management", Strategic Management Journal, 11(3), pp.171~195 (1990)
  26. Morgan, R.T., "Image of organization" (1986), Sage Publications
  27. "National Defense Science and Technology Vocabulary", ~ (2011)
  28. Pfhleeger, C.P., "Security in Computing" (1997), Prentice Hall
  29. Phares, E.J., "Introduction to personality" (1984), Carles E. Merrill
  30. Rich, P., "The Organizational Taxionomy : Definition and Design", Academy of Management Review, 17(4), pp.758~781 (1992)
  31. Sanchez, J.C., "The Long and Thorny way to an Organizational Taxonomy", Organization Studies, 14(1), pp.73~92 (1993)
  32. Sarker, S., "Using an Adapted Grounded Theory Approach for Inductive Theory Building About Virtual Team Development", DATA BASE for Advances in Information Systems, 2(1), pp.38~56 (2001)
  33. Schneier, B., "Secrets & Lies-Digital Security in a Networked World" (2002), Wiley Computer Publishing
  34. Sherwood, J., "SALSA : A Method for Developing the Enterprise Security Architecture and Strategy", Computers and Security, 15(6), pp.501~506 (1996)
  35. Smith, E., "Information Security Education", Proceedings of the WISE 4 Conference (2004)
  36. Solms, V., "The 10 Deadly Sins of Information Security Management", Computers and Security, 23(5), pp.371~376 (2004)
  37. Spears, J.L., "User Participation in Information Systems Security Risk Management", MIS Quarterly, pp.503~522 (2010)
  38. Survey of personal information, , Ministry of Science, ICT and Future Planning, ~ (2015)
  39. Thomson, M. E., "Information Security Awareness : Educating Your Users Effectively", Information Management and Computer Security, 6(4), pp.167~173 (1998)
  40. Von Solms, R., "From policies to culture", Computers and Security, 23(4), pp.275~279 (2004)
  41. Von Solms, S.H., "Information Security Management through Measurement", Proceedings of the SEC99 conference (1999)
  42. Werlinger, R., "Preparation, detection, and analysis : the diagnostic work of IT security incident response", Information Management and Computer Security, 18(1), pp.26~42 (2010)
  43. Wood, C. C., "Why Information Security is Now Multi-Disciplinary, Multi-Departmental, and Multi-Organizational in Nature", Computer Fraud and Security, (1), pp.16~17 (2004)
  44. Yngstrom, L., "A Systemic-Holistic Approach to Academic Programmes in IT Security", Ph.D, Department of Computer and Systems Sciences, pp.1996

관련 논문AI추천

쌍대비교를 활용한 기업 유형 분류에 따른 보안 전략 우선순위 결정김희올, 백동현한국산업경영시스템학회 · 한국산업경영시스템학회지2016 · 제39권 제4호기업 정보보안 전략 수립을 위한 보안 사고 유형 분류에 관한 연구김희올, 백동현한국산업경영시스템학회 · 한국산업경영시스템학회지2015 · 제38권 제4호산업별 정보보안의 투자 수준과 관리 역량에 관한 연구정병호, 주형근(사)디지털산업정보학회 · (사)디지털산업정보학회 논문지2023 · 제19권 제2호정보보호관리체계(ISMS)를 이용한 중소기업 기술보호 개선방안 연구김성준, 김정은(사)디지털산업정보학회 · (사)디지털산업정보학회 논문지2016 · 제12권 제3호기밀정보 유출 경험을 가진 기업들의 정보사고 대응역량 강화에 관한 연구정병호(사)디지털산업정보학회 · (사)디지털산업정보학회 논문지2016 · 제12권 제2호중소기업 정보보호 컨설팅 개선을 위한 방법론 비교 분석장상수중소기업융합학회 · 융합정보논문지2020 · 제10권 제8호

이 간행물의 다른 논문 (20건)

한국형 위성항법시스템을 위한 위성군집궤도 최적 설계김흥섭, 김한별pp. 1-9로버스트 기대손실 관리도의 설계이형준, 정영배pp. 10-17Shuttle-Based Storage/Retrieval System(SBS/RS)에서의 셔틀 대기점 연구하윤수, 채준재pp. 30-38전신 피로와 시야 제한이 자세균형 능력에 미치는 영향박성하pp. 39-46오프라인 소매점의 모바일 할인 서비스에 대한 전략적 분석조형래, 이민호pp. 47-55
원문 보기