Loading...
|
Please use this identifier to cite or link to this item:
https://nccur.lib.nccu.edu.tw/handle/140.119/95263
|
| Title: | 資料外洩稽核工具之設計與實作
Design and implementation of an audit tool for data leakage |
| Authors: | 高華志
Kao, Hua Chih |
| Contributors: | 陳恭
Cheng, Kung
高華志
Kao, Hua Chih |
| Keywords: | 資料外洩
稽核工具
資訊安全
隱碼攻擊
ISO27002
ISO 13569
Data Leakage Prevention
Audit Tools
Information Security
ISO27002
ISO 13569
Injection Flaws
SQL Injection
DLP |
| Date: | 2009 |
| Issue Date: | 2016-05-09 15:28:56 (UTC+8) |
| Abstract: | 隨著國內法令規範對於隱私政策更加重視，國內外企業組織因應鉅額罰款與政策的施行，再加上個人資料外洩事件頻傳，各企業無不擔心客戶資料的保護與落實內部資料控制。而大型政府機關或企業，由於服務範圍廣大，應用系統繁多，針對資料外洩的保護與落實，將更加的複雜。大部份的組織針對實體文件、安全性儲存設備管制、使用採購防火牆設備等，皆有進行相關的管理與設備的採購，但上述機制未能解決應用系統的資料外洩問題。對稽核人員而言稽查應用程式是否有資料外洩之虞，由應用程式原始程式碼相當實為不易，而新制定一套更安全存取控管的介面更需投入相當高的成本與時間。
The rapid spread of information technologies into every facet of our life results in a surge in attention to privacy recently. Bills are enacted and a comprehensive privacy policy becomes a sign of a responsible corporation. However, the complexity and diversity of application systems of information makes it very difficult to ensure that the information systems conform to all the privacy regulations and polices. Although most corporations have established some privacy policies for controlling physical documents and various hardware devices, the main problem for data leakage is at application layer. Application developers could retrieve sensitive data by exploiting application flaws. This poses great challenges to information system auditors. Firstly, it is rather difficult for auditors to review the code to spot the flaws. Secondly, it is impractical to make a new coding standard and re-write the legacy applications accordingly. Thirdly, application developers lack the motivation to improve the protection level of existing systems. |
| Reference: | 【1】 個人資料保護法, 行政院, 2008
【2】 CNS 17799－資訊安全管理之作業要點, 經濟部標準檢驗局, 2002
【3】 ISO-IEC 27002 Information technology- Security techniques- Code of practice for information security management, ISO, 2005
【4】 ISO/TR 13569 Banking and related financial services — Information security guidelines, ISO, 2003
【5】 More Than Half of Ex-Employees Admit to Stealing Company Data According to New Study, http://www.symantec.com/about/news/release/article.jsp?prid=20090223_01
【6】 Introducing SQL Server Profiler, http://msdn.microsoft.com/en-us/library/ms181091.aspx
【7】 RadControls for ASP.NET AJAX, http://www.telerik.com/help/aspnet-ajax/introduction.html
【8】 Role-based access control,
http://en.wikipedia.org/wiki/Role-based_access_control
【9】 AJAX,
http://zh.wikipedia.org/wiki/AJAX
【10】 Avoid The SQL Injection,
http://www.microsoft.com/taiwan/sql/SQL_Injection.htm
【11】 SQL Injection,
http://en.wikipedia.org/wiki/SQL_injection
【12】 Injection Flaws,
http://www.owasp.org/index.php/Injection_Flaws
【13】 OWASP Top 10 Project,
http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
【14】 SQL Server Books online,
http://msdn.microsoft.com/en-us/library/ms130214.aspx
【15】 IS Standards, Guidelines and Procedures for Auditing and Control Professionals, ISACA, 2008 |
| Description: | 碩士
國立政治大學
資訊科學學系
95971014 |
| Source URI: | http://thesis.lib.nccu.edu.tw/record/#G0095971014 |
| Data Type: | thesis |
| Appears in Collections: | [資訊科學系] 學位論文
|
Files in This Item:
| File |
Size | Format | |
|---|
| index.html | 0Kb | HTML2 | 276 | View/Open |
|
All items in 政大典藏 are protected by copyright, with all rights reserved.
|
