AStudyonTheAffectingFactoriesofOrganizationalInformationSecurityActivitiesandThePerformanceofInformationsecurityofOrganization

[[abstract]]近年來，由於網際網路與資訊系統被企業大量的運用，以提昇工作效率、降低營運成本，並增加企業的競爭力；然而當組織越來越依賴以電子化的方式來完成交易的同時，資訊安全的危害也不斷地增加，為了因應不斷增加的資訊安全問題及維持組織的競爭力，管理者必須面對的課題是組織該採取何種資訊安全活動，才能在資訊快速交流的前提下有個安全的資訊環境，降低資訊安全的威脅。儘管目前管理者對資訊安全意識漸增，且有學者陸續提出資訊安全相關文獻，而企業內懂得資訊安全的高階主管不多，於是投入大量金錢與人力，卻無法有效解決資訊安全漏洞，錯失提昇組織績效的時機，因此，如何評估組織所適用的資訊安全行動，實屬重要。 本研究依據相關文獻探討，提出組織資訊安全活動及資訊安全績效的評估模式與相關假說，並以問卷調查法針對資訊人員對組織內的資訊安全活動與其績效進行調查，來實證其相關性。研究結果發現：1.組織大小對嚇阻、預防、偵測及回復等活動有正向顯著影響；2.高階主管的支持對嚇阻、預防、偵測及回復等活動有正向顯著影響；3.高階主管的安全意識對嚇阻、預防、偵測及回復等活動有正向顯著影響；4.產業型態對嚇阻、預防、偵測及回復等活動有正向顯著影響；5.嚇阻活動對資訊安全績效有正向顯著影響；6.預防活動對資訊安全績效沒有顯著影響；7.偵測活動對資訊安全績效有正向顯著影響；8.回復活動對資訊安全績效有正向顯著影響。 本研究所實證之資訊安全績效評估，希望不僅能提醒高階主管避免資訊安全的威脅，並加強風險評估之外，更希望能運用此研究成果來幫助決策者，在進行資訊安全活動決策時提供適時的參考，以確保組織所推行的資訊安全活動能獲得最大的績效。[[abstract]]Internet and information system go into a mass operation by the enterprises in order to promote the efficient management and to decrease the cost of operation and to increase the competition of the business. Increased organizational dependence on IS has led to a corresponding increase in the impact of IS security abuses. When the E-system is used to support the organizations, there are very important things for managers on the premise that data exchange rapidly to face how to take Information Security Activity to protect the Information System Security, and to have a safety environment of the information, and to decrease the threat of the security information。 So far as the domestic is concerned, the mangers are clearly understanding about the information security awareness gradually. Scholars submit their proposals for information security but the tops of managers in Taiwan don’t realize the information security, as a consequence, they invest a lot of money in buying security products such as: Firewall, Intrusion Detection System, and Anti-virus, but those products still have the security leak and Hacker invades into the systems and menace companies with the security leak. It is not only the waste of money but also of manpower. So that it is very important how to assess a suitable set of Information Security Activities for organizations. According to Combining literature researches this paper proposes the information security activities, and information assessing model, and constructional related hypothesis; to use the questionnaires about investigation of information security activities and information achievements is to understand that the top managers affect the organizations. As a result, the report found eight key points: The organizational size has obviously positive affections to the information security that deterrence, prevention, and recovery activities. The top managers support the information security that deterrence, prevention, and recovery activities will be obviously positive affection, but detection activity will be obscure. The top managers have the information security awareness the deterrence; prevention, recovery, and deterrence activity will be obviously positive affections. The industry type has obviously positive affections to the information security that deterrence, prevention, and recovery activities. The deterrence activities have obviously positive affections to information security awareness. The prevention activities don’t have obviously affections to information security awareness. The detection activities have obviously positive affections to information security awareness. The recovery activities have obviously positive affections to information security awareness. The report has confirmed that the information security performance not only can remind the top managers of avoiding the information security threats, but also can enhance the estimation of risk. Hopefully, the report can assist the management decision-making in time for the top managers, and makes sure to maximize the organizations information security performance on being carried information security activities out