機關文檔及資訊人員對於文檔系統資安意識之調查—以桃園市為例

Abstract

我國推動資通安全政策已行之有年，包含法制化及機制建立，然而資安議題與機關人員業務息息相關。隨著電子化文書及檔案的累積，政府機關也需面對不斷翻新的資安威脅，而在文檔系統當中，資訊人員扮演機關整體規劃的角色，文檔人員在過程中則擔任第一線的關鍵角色。本研究目的即在於發展可資評估機關文檔人員及資訊人員資安意識之調查問卷，並調查分析文檔人員及資訊人員對於文檔系統資安意識現況及差異。\n本研究首先在國內外文獻探討及考量臺灣環境的基礎下，設計最初評估題項，接著採用疊慧法，綜合檔案學者及資訊學者二回合的意見，建立「資安意識評估問卷」，並透過Cronbach’s α係數值及驗證性因素分析確立達到良好的信效度。其次採用問卷調查法，採立意抽樣及滾雪球抽樣方式，調查對象為桃園市地方一級機關的資訊人員及文檔人員，包含「認知重要性」及「機關達成程度」兩個向度。\n在資安意識評估內容階段，研究結果顯示：（一）不同背景的學者專家對於資安意識有高度共識；（二）確立資安意識評估10個構面，分別為「帳戶管理」6題、「存取控制」10題、「系統防護」9題、「行動安全」2題、「上網行為」7題、「電子交換」5題、「實體安全」14題、「備份機制」5題、「遵守政策」6題及「事件通報」構面3題；共計67題。\n在資安意識調查分析階段，研究結果顯示：（一）整體資安意識偏正向且趨於一致；（二）機關文檔及資訊人員的資安意識程度，「認知重要性」向度略高於「機關達成程度」向度，兩向度及構面之間達顯著正相關；（三）機關文檔及資訊人員對於機關在資安作業上的符合程度，僅存有約5%不清楚的比例；（四）年齡是影響資安意識程度的重要因素之一，超過40歲人員的資安意識程度高於40歲以下人員；（五）有無接受教育訓練是影響資安意識程度的重要因素之一，有接受教育訓練者的資安意識程度高於未接受教育訓練者，但不限於資訊教育訓練；（六）不同職務身分背景對於資安意識程度沒有影響，差異僅反映在個別構面，其中不含委外的資訊人員資安意識程度相對較高，而文書人員、委外人員的資安意識程度相對較低;（七）服務年資背景對於整體資安意識程度沒有影響，差異僅反映在個別構面，其中服務年資滿5年未滿10年的人員的資安意識程度相對較低。\n本研究結果所建立的「資安意識評估問卷」，可供機關在進行人員資安意識評估的應用；而所調查的資安意識評估結果，可做為機關規劃資安教育訓練之參考。

The information and communications technology security policies have been promoted for several years. However, people within or employees are seen as a critical factor for having excellent security implementation and should take their role seriously. With the increasing popularity of Electronic Records Management Systems （ERMS), the record management and information staff have become an integral part of the process. The purpose of this research is to develop an assessment questionnaire that includes two dimensions: cognitive importance and organization achievement level, that could assess the cybersecurity awareness of record management and information staff to investigate the comparison of these two groups.\nThe study had a two-stage mixed-method design. First, the Delphi method involved a two-round consensus method to determine the questionnaire’s content. Second, the questionnaire survey method was applied to collect the research data of local authorities in Taoyuan City.\nIn the first stage, the results indicated: （1) Scholars and experts from different backgrounds have a high consensus on cybersecurity issues; （2) The 10 mutually related aspects with 67 scale items which are account management, access control, system protection, mobile safety, internet behavior, electronic exchange, physical security, backup, adhere to policies and incident notification were identified.\nIn the second stage, the results indicated: （1) The overall information security awareness is positive and consistent; （2) The score of the dimension of cognitive importance is slightly higher than the score of the dimension of organization achievement, and there is a significant positive correlation between the 2 dimensions and 10 aspects; （3) Only about 5% are unclear about the degree of compliance of agencies in information security operations. （4) People over 40 years old have a higher level of information security awareness than people under 40 years old; （5) People who have received education and training from government agencies have a higher level of information security awareness than people who have not received, but it is not limited to information categories; （6) There is no considerable difference of cybersecurity awareness among different job backgrounds in the total aspect, only reflected in the individual aspect; （7) There is no considerable difference in the level of information security awareness among the background of service years in the total aspect.\nGovernment agencies could use the assessment questionnaire established by the results of this study in conducting personnel security awareness assessments, and based on the findings of the study; some suggestions are provided for government agencies to plan information security education and training.