資訊管理學報
游佳萍;趙慕芬;林美齡;
頁: 287-314
日期: 2023/07
摘要: 組織頻頻發生資訊安全事件，會損害競爭力，因此，對資訊安全策略的重視，已經是基本工作。本研究採用PEST分析中政策和法律、經濟成本、社會文化，以及技術科技四個構面，作為分析架構。深度訪談三位資訊安全顧問，取得15個個案的相關資訊，利用內容分析法整理訪談資料，以了解PEST四個構面對資訊安全策略，所扮演的推手角色。本研究有幾個發現：第一，社會文化是影響公部門資安策略的首要構面，對於私部門而言，首要構面則是技術科技；第二，公、私部門都重視員工資訊安全認知、顧問的專業資安技術以及資訊安全投資成本等。細觀後發現，公部門受限於官僚制度，將資訊安全單位之職責與分工，視為重要議題，而私部門則較重視資訊安全投資成本。本研究從宏觀環境分析的角度，界定公私部門面對資訊安全議題時，所著重的環境因素。本研究結果可以幫助公部門與私部門，在規劃資訊安全策略時，能有更完整的視野。
關鍵字: 資訊安全策略;PEST分析;內容分析;公部門;私部門;
Abstract: The frequent occurrence of information security incidents harms the competitive power of the organizations affected. Therefore, it is essential to emphasize information security strategy. This study conducted interviews with three security consultants of fifteen cases and applied the content analysis based on the structure of PEST analysis to extract the political, economic, social and technical, and technological behind information security strategy. There are several findings: first, the social factor is the priority for the public sectors, and the technical and technological factor is for the private sectors. Second, public and private sectors would stress information security awareness, professional information security skills and knowledge, and investment cost evaluation of information security management. In detail, for the public sectors, the clear responsibilities definitions which reflect the accountability in their bureaucratic system are a critical issue in the information security strategic plan. However, they attach great importance to the investment cost of information security management for the private sector. Finally, this study identified the important environmental factors facing information security issues from macro-environment perspectives. Our findings could help strategic information security planning in the public and private sectors.
Keywords: information security strategy, PEST analysis, content analysis, public sector, private sector;
瀏覽次數: 8675 下載次數: 284
引用 導入Endnote
頁: 287-314
日期: 2023/07
摘要: 組織頻頻發生資訊安全事件，會損害競爭力，因此，對資訊安全策略的重視，已經是基本工作。本研究採用PEST分析中政策和法律、經濟成本、社會文化，以及技術科技四個構面，作為分析架構。深度訪談三位資訊安全顧問，取得15個個案的相關資訊，利用內容分析法整理訪談資料，以了解PEST四個構面對資訊安全策略，所扮演的推手角色。本研究有幾個發現：第一，社會文化是影響公部門資安策略的首要構面，對於私部門而言，首要構面則是技術科技；第二，公、私部門都重視員工資訊安全認知、顧問的專業資安技術以及資訊安全投資成本等。細觀後發現，公部門受限於官僚制度，將資訊安全單位之職責與分工，視為重要議題，而私部門則較重視資訊安全投資成本。本研究從宏觀環境分析的角度，界定公私部門面對資訊安全議題時，所著重的環境因素。本研究結果可以幫助公部門與私部門，在規劃資訊安全策略時，能有更完整的視野。
關鍵字: 資訊安全策略;PEST分析;內容分析;公部門;私部門;
The critical drivers behind information security strategy in public and private sectors in Taiwan
Abstract: The frequent occurrence of information security incidents harms the competitive power of the organizations affected. Therefore, it is essential to emphasize information security strategy. This study conducted interviews with three security consultants of fifteen cases and applied the content analysis based on the structure of PEST analysis to extract the political, economic, social and technical, and technological behind information security strategy. There are several findings: first, the social factor is the priority for the public sectors, and the technical and technological factor is for the private sectors. Second, public and private sectors would stress information security awareness, professional information security skills and knowledge, and investment cost evaluation of information security management. In detail, for the public sectors, the clear responsibilities definitions which reflect the accountability in their bureaucratic system are a critical issue in the information security strategic plan. However, they attach great importance to the investment cost of information security management for the private sector. Finally, this study identified the important environmental factors facing information security issues from macro-environment perspectives. Our findings could help strategic information security planning in the public and private sectors.
Keywords: information security strategy, PEST analysis, content analysis, public sector, private sector;
瀏覽次數: 8675 下載次數: 284
引用 導入Endnote