企业资安策略思维.pdfVIP

業資業資安安策策略思維略思維 吳宗 成博士 台灣科技大學台灣科技大學管管理理學院學院院長院長 台灣科技大學資訊管理 系教授 中華民國資訊 安全學會理事長 TWISC＠NTUST 1 Investment of IT Type –– StStrraattegiegicc ininvveessttmenmentt (c(compeompettiittiivvee adadvvananttage)age) – Informational investment (management control) – Transactional investment (operational support) – Infrastructural investment (basic foundation) CCoostst – Hardware (physical) Software – People (human resources) Promotion 2 Return of Investment of IT Creative Service – Tangible value ‡computed exactly •• RReettuurrnedned vvaluealue I Innvveessttmmentent • Business model that make money – Intangible value ‡cannot be estimated • Image of enterprise (organization) Effective Management – Tangible value ‡direct benefit •• TTiimmee (r (redueducicingng pprroduoduccttionion ccoosst)t) • Quality (getting more amount of sales) – Intangible value ‡indirect benefit • Image of enterprise (organization) • Capability improvement (human resources) 3 Investment of Security Type –– OOffffenenssee ((aaccttiivvee tthhrreaeat)t) • No commercial company shall ( 宜) do • Only a few nations or people will (可 ) do – Defense • Every commercial company must (須) do •• MoMosstt ooff nanattionionss oorr peoplepeople sshouldhould ( (應應)) dodo Cost – Hardware (physical) Software – People (human resources) 4 Return of Investment of Security Expected result – Value Investment AAccttualual r reessultult – Defensive investment Offensive investment – Intangible value