기업의 내부 인력 보안을 위한 IT 외주 용역 특성 분석 = Analysis of Characteristics of IT Outsourcing for Insider Security of Enterprise

다국어 초록 (Multilingual Abstract)

As many enterprises implement an information system to manage their business, IT outsourcing that operates and manages the system is increasing. Information systems can integrate all business resources and manage business processes, which enables the outsourced employees to obtain critical information about enterprise business. Actually, a large portion of security incidents regarding information leakage of enterprises are being caused by IT outsourcing. However, there is a lack of guidelines that can be used to establish security measures for the outsourcing, because domestic and foreign information security management systems (ISMS) do not specify various types of IT outsourcing even though they provide security requirements for organizations. In this paper, we classify various types of IT outsourcing and define their characteristics considering information system’s architecture, such as the status of network isolation, IT resource type, employees’ location and their access authorization.

참고문헌 (Reference)

1 지식경제부, "중소기업의 기술보호를 위한 세부 보안통제실행지침서"

2 법률지식정보시스템, "정보통신망 이용촉진 및 정보보호등에 관한 법률"

3 장상수, "정보보호관리체계(ISMS) 인증심사 결함사항 분석에 관한 연구" 20 (20): 31-38, 2010

4 한국정보보호진흥원, "정보보호관리체계 통제사항 가이드"

5 한국정보보호진흥원, "정보보호관리체계 인증제도 소개"

6 한국정보보호진흥원, "정보보호 관리체계 개요"

7 한국정보보호진흥원, "정보보호 거버넌스 개념 도입을위한정보보호관리체계(ISMS)발전방안연구" 2009

8 행정안전부, "국가정보통신서비스 이용제도"

9 ISO/IEC, "ISO/IEC 27001: Information technology – Security techniques - Information security management systems–Requirements"

10 ISO, "ISO and International Standards for Security" 2006