정보보안의 비용효과분석에 관한 연구 = A Study on Cost-effectiveness analysis of Information Security

다국어 초록 (Multilingual Abstract)

The disclosure of cost effectiveness analysis regarding information security analysis
activities of companies and other organizations, including public interest organizations
and local public entities, provides a means for stakeholders to understand, evaluate, and
give their support to such efforts. cost effectiveness analysis continues to take root as
part of the social system.
This Paper have been revised taking into account developments in cost effectiveness
analysis at companies and other organizations, with the objective of supporting the
introduction and implementation of cost effectiveness analysis at companies and other
organizations. As much attention as possible is given to items to be taken into
consideration in the disclosure of information, so that the cost effectiveness analysis
data composed and published in accordance with this paper has the highest degree of
comparability possible. This Paper is also intended to insure that the information
disclosed takes into consideration the needs of the various stakeholders.
The disclosure of cost effectiveness analysis data as one of the key elements in an
information security report enables those parties utilizing this information to get an
understanding of the company's stance on information security analysis and how it
specifically deals with information security issues.
The quantitative management of information security analysis activities is an
effective way of achieving and maintaining sound business management. In other
words, in carrying out information security analysis activities, a company or other
organizations can accurately identify and measure investments and costs related to
information security analysis activities, and can prepare and analyze this data. By
having better insight into the potential benefit of these investments and costs, the
company can not only improve the efficiency of its activities, but cost-effectiveness
analysis also plays a very important role in supporting rational decision making.
In addition, companies and other organizations are required to have accountability to
stakeholders, such as consumers, business partners, investors, employees, local
residents, and administration, when utilizing information security resources, i.e. public
goods, for their business activities. Disclosure of cost effectiveness analysis is a key
process in performing accountability. Consequently, cost effectiveness analysis helps
companies and other organizations boost their public trust and confidence and are
associated with receiving a fair assessment.

국문 초록 (Abstract)

기업이 정보보안의 비용효과분석을 행함으로써 이해관계자가 기업의 목표 및 방향을 올
바르게 이해하고, 평가, 지원하는 것이 사회시스템의 하나로 정착되어가고 있다. 본 연구
에서는 기업의 정보보안의 비용효과분석의 도입과 실천을 지원하는 것을 목적으로 하고
있다. 또한, 정보보안의 비용효과분석에 대한 연구를 통하여 외부공표 뿐만 아니라, 내부
관리상에서도 정보보안관리의 목적에 따른 데이터파악이 진전되고, 비용효과분석의 유효
성이 한층 증가되는 것을 지향한다.
기업의 경영전략에 있어, 정보보안의 비용효과분석에 대한 대응을 구체화하고, 비용효
과분석에 대한 대응을 내부화한 정보보안관리의 사업활동을 전개하는 기업 등이 증가하고
있다. 정보보안의 비용효과분석에 대한 기업의 대응은 이러한 정보보안관리를 배려한 사
업활동의 일환이다. 정보보안관리에 대한 대응책으로서 정량적으로 관리하는 것은 사업경
영을 건전하게 유지함에 있어 매우 유효한 전략이다. 즉 기업이 정보보안관리에 대응함에
있어, 기업 스스로의 정보보안의 비용효과분석에 관한 투자액과 비용액을 정확하게 인식
하고, 측정하여 집계·분석을 실시하고, 그 투자와 비용에 대한 효과를 인식하는 것은 정
보보안관리대응의 효율성을 한층 높이는 것이며, 합리적인 의사결정을 행하는데 매우 중
요하다. 그 결과, 기업의 사회적인 신뢰가 높아지고, 기업에 대한 이해관계자의 적정한 평
가를 확립하게 되는 것이다.

참고문헌 (Reference)

• 1 "http://www.nist.gov" 미국국립표준기술원
• 2 "Recommendation of the Council Concerning Guidelines for Protecting Consumers from Fraudulent and Deceptive Commercial Practices Across Borders"
• 3 "OECD adopts Guidelines for Cryptography Policy" 97 (97): 1997
• 4 "OECD Guidelines for Consumer Protection in the context of Electronic Commerce"
• 5 Michael J.Wenstrom, "Managing Cisco Network Security 1st edition" Cisco Press 2001
• 6 "Federal Information Security Management Act(2004 Annual FISMA Report)"
• 7 "Draft Recommendation on Consumer Dispute Resolution and Redress"
• 8 Mishan,E.J, "Cost-Benefit Analysis" Prager Publishers. 1976
• 9 Elizabeth D.Zwicky, "Building Internet Firewalls(2nd Edition)" O'Reilly Media 2000