Browsing by Author "Farn, Kwo-Jean"

Now showing 1 - 7 of 7

A study on critical infrastructure Information Technology Malfunction controls - Illustration of Taiwan
(2008)
Farn, Kwo-Jean
;
Lin, Shu-Kuo
;
Lin, Kuo-Sui
;
Yang, Chung-Huang
;
資訊管理與財務金融系註：原資管所+財金所
A critical infrastructure (CI) consists of those physical and information technology facilities, networks, services and assets which, if disrupted or destroyed, have a serious impact on the health, safety, security or economic well-being of citizens or the effective functioning of governments. Nowadays, the operation controls of these infrastructures have been computerized and have gradually become open systems. The Malfunction controls of the Information Technology (IT) have been one of the focuses in the researches of information security management in Industrial Control System (ICS). In this paper we discuss the IT Malfunction of ICS security incidents which occurred in Taiwan, and explore the details of the controls for CI.
A study on e-Taiwan information system security classification and implementation
(2008-01-01)
Farn, Kwo-Jean
;
Lin, Shu-Kuo
;
Lo, Chi-Chun
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Information systems of Cyberspace offer attractive targets. They should be resistant to such as Active Attack, Passive Attack, Insider Attack, Close-in Attack, and Distribution Attack from the full range of threat-agents-from hackers to nation states-and they must limit damage and recover rapidly when attacks do occur. According to Common Criteria (CC), Information Security Management System (ISMS) and the international standards of Information System Security (ISO/IEC 15408, ISO/IEC 17799, and ISO/IEC TR 19791) as well as the other international standards and guidelines such as the framework of Defense-in-Depth promoted by the U.S., in this paper we propose a new framework of information system security classification for e-Taiwan to reach the vision '' information and communication network resources can be fully used in an obstacle free and secure environment by year 2008.'' (C) 2007 Elsevier B.V. All rights reserved.
A Study on Information Security Management with Personal Data Protection
(2011)
Huang, Chien-Cheng
;
Farn, Kwo-Jean
;
Lin, Frank Yeong-Sung
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
In the process of standardization, whether the announcement of a standard represents a cause or an outcome, it is opportunity of the trend of standardization or achievement. The process of standardization is to understand "why" and "how" to explore the detailed outline of a time flow. From a long-term perspective, a standard is the milestone of the standardization process. On May 26th 2010, with the announcement of the Personal Data Protection Act in Taiwan, information security management (ISM) of the Personal Data Protection Act has received much attention from the public. This study is centered on the working items of standards announced by the International Organization for Standardization (ISO) and the ongoing information security management system (ISMS) standards and standardization in order to propose standards which comply with the ISMS of the Personal Data Protection Act and methods which increase implementation control measures.
A study on information wrapper protection profile
(2007)
Farn, Kwo-Jean
;
Lin, Shu-Kuo
;
Hwang, Jiann-Ming
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
How to help the end-users to identify and analyze the attacks in cyberspace has become extremely important to the information security task. Based on the standard of the Information Security Audit and Alarms Framework published by ISO, in this paper we intend to investigate the security functional and security assurance requirements of the so-called Information Wrapper. Besides, in this paper we also propose a draft Protection Profile (PP) of Information Wrapper. The draft has been registered in the Chinese National Laboratory Accreditation (CNLA) as the security specification of relevant products and/or systems.
CORAS for the Research of ISAC
(2008)
Fu, Ya-Ping
;
Farn, Kwo-Jean
;
Yang, Chung-Huang
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
The development of the Internet has elicited the importance of information security. For national information security, other than providence and release of information security protection messages, critical infrastructure information protection (CIIP) has also become part of the overall network security. How to integrate the related information security data for industries and establish the integrative monitoring and analytical platform is the first priority at Taiwan. Hence, the establishment of the Information Sharing and Analysis Center (ISAC) for critical infrastructures has become the most important topic at present. The ISAC establishment places the greatest emphasis on information exchange and analysis so that there must be a unified standard for the exchange format and operation. Because the differences between critical infrastructures are quite large and the sources of the workflow processes and threats are not quite the same, a public tool is required for such establishment. This research discusses how to use Consultative Objective Risk Analysis System (CORAS) to establish ISAC of critical infrastructures and takes a telecom company as an example to simulate episodes of possible risks that might occur and to discuss how it functions, how it is established, and how it handles risks.
Software Vulnerability Patch Management with Semi-Markov Decision Process
(2013-11-01)
Huang, Chien-Cheng
;
Farn, Kwo-Jean
;
Lin, Feng-Yu
;
Lin, Frank Yeong-Sung
;
資訊管理與財務金融系註：原資管所+財金所
Information security incidents frequency has been increasing dramatically, the aim of this study is to analyze the state-space reachability problems through the transition of vulnerable status after the informative system vulnerability exposure. In this research we took into consideration the time factor to analyze the arrival time to reachable states problem discussed in stochastic Petri nets. The mean arrival time and variance of the process between starting from an initial state and arriving at reachable states. We will therefore elaborate a novel model based on the semi-Markov stochastic Petri nets model for analyzing the period between the exposure of the vulnerability and the completion of its patch. We use the semi-Markov process to analyze the state-space reachability problems of the stochastic Petri nets, resulting in a novel model for software vulnerability patch management. Moreover, we include also the concept of discounted multi-objective semi-Markov decision process to obtain the total of the efficient extreme point set.
Study on applying ISO/DIS 27799 to medical industry's ISMS
(2007)
Farn, Kwo-Jean
;
Hwang, Jiann-Ming
;
Lin, Shu-Kuo
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
At present, as medical care sites use more and more IT system, information systems have come to play an important role in the business operation of medical organizations. It is an important goal for management at medical organization in Taiwan to keep the security of medical informatics. HIPAA had been run about ten years in USA, thought its efficiency has still remained to be seen, HIPAA has become the benchmark of the information governance in the information security of medical industry. The Department of Health of Taiwan had adapted from HIPAA and issued the HISPP/GD that included 9 principles and 12 articles altogether. This text will probe into the ISO/DIS 27799, the feasibility of applying it to the management of domestic medical organization and the corresponding detail of ISMS. By this way, we hope that Taiwan's medical organization can build a medical information system and manageable environment that according with the security requirements of confidentiality, integrality and availability.