[[alternative]]The Study of Constructing the Disaster Recovery Mechanism for Information and Communication Security

[[abstract]] 隨著近年來資訊科技的發展，導入資訊技術以提昇組織效率與競爭力已經是全球的趨勢。而在近年來全球資訊安全事件不斷發生，資訊犯罪手法不斷翻新，為保護組織內部資訊相關資產並保持組織持續運作，導入資訊安全管理系統（Information Security Management System ，簡稱ISMS）便是一套可有效控制管理之方法。 國際間建構資訊安全管理系統通常採用BS7799與ISO/IEC17799資訊安全管理規範為標準，以此標準來管理組織內部資訊的運用、資訊硬體的安全以及資訊使用者的控管，以達成資訊資產的「機密性」、「完整性」及「可用性」。 本研究以個案研究方式，對一正以BS7799標準導入資訊安全管理系統之非營利機構進行訪談與實地觀察，探討其資訊安全管理系統並規劃其資訊備援機制的流程，在資訊安全事件發生時以保護組織之資訊資產安全，並且能在最短的時間內完成後續重建及恢復作業事宜，以達成資訊安全管理規範之完整性及可用性。[[abstract]] Applying information technology to promote the organization efficiency and competitiveness will be the development trend in recent years. Information Security Management System (ISMS) had been known as a way to keep and protect the stable and continuous operation of the information assets for most organizations. BS7799 and ISO/IEC17799 will be the international standard frequently used to construct the information security management security for most organizations. Applying BS7799 and ISO/IEC17799 to manage the application of information, the safety of hardware and the right of users will reach “Confidentiality”, “Integrity” and “Availability” of information assets. This research uses case study technique to investigate a non-commercial organization which applying the ISMS based on BS7799 standard. The ISMS will be initially discussed, and the information recovery mechanism process will be then constructed in this study. The information assets can be protected, built and recovery at the shortest time by using the constructed information recovery mechanism process when information security events happen