臺灣博碩士論文加值系統

More and more organizations are becoming dependent on the information technology (IT) and information systems (IS). It is a crucial task that be protecting and continuing the business operation for organizations. The selection testing alternative of business continuity planning (BCP) is a multiple criteria decision making (MCDM) problem. We design a decision support method to determine the appropriate testing alternative of business continuity plan for organizations with analytic network process (ANP) and fuzzy goal programming (FGP). Then we use a numerical example of eight companies in Taiwan to demonstrate this method. To conclude, we give a guideline for using the method extending to other decision problem.

More and more organizations are becoming dependent on the information technology (IT) and information systems (IS). It is a crucial task that be protecting and continuing the business operation for organizations. The selection testing alternative of business continuity planning (BCP) is a multiple criteria decision making (MCDM) problem. We design a decision support method to determine the appropriate testing alternative of business continuity plan for organizations with analytic network process (ANP) and fuzzy goal programming (FGP). Then we use a numerical example of eight companies in Taiwan to demonstrate this method. To conclude, we give a guideline for using the method extending to other decision problem.

1. INTRODUCTION 1
1.1 BACKGROUND 1
1.2 MOTIVATION 3
1.3 RESEARCH PROBLEM AND OBJECTIVE 5
1.4 RESEARCH AREHITECHTURE 6
1.5 RESEARCH CONTRIBUTION 6
2. LITERATURE REVIEW 7
2.1 BUSINESS CONTINUITY PLANNING 7
2.1.1 The component of the BCP 11
2.1.2 The success factors of BCP 15
2.1.3 The testing alternative of BCP 19
2.2 ANALYTIC NETWORK PROCESS 20
2.2.1 The supermatrix 22
2.3 FUZZY GOAL PROGRAMMING 27
3. PROPOSED METHOD 30
3.1 RESEARCH STRUCTURE 30
3.2 DETERMINING THE CRITERIA AND ALTERNATIVES OF THE BCP 31
3.3 CONSTRUCT THE ANP MODEL AND DETERMINE THE RELATIONSHIPS OF THE CRITERIA AND ALTERNATIVES 34
3.4 CALCULATE THE WEIGHTS OF THE ALTERNATIVES 35
3.5 FORMULATE FUZZY GOAL PROGRAMMING CONSTRUCTION 36
4. MODEL DEFINING AND VALUE CALCULATING 41
4.1 NUMERICAL EXAMPLES 41
4.2 CALCULATE THE PRIORITIES OF THE CRITERIA AND ALTERNATIVE 43
4.3 FORMING SUPERMATRIX 49
4.4 FUZZY GOAL PROGRAMMING FORMULATION 54
5.CONCLUSION AND FUTURE WORK 58
5.1 IMPLICATION AND CONCLUSION 58
5.2 FUTURE WORK 59
REFERENCE 61
APPENDIX A ANP RESULTS 68
APPENDIX B LINGO CODE 79
APPENDIX C ANP QUESTIONNAIRE 80

[1]Q.-J. Y. Jung-Ting Chang, "On security preparations against possible IS threats across industries " Information Management & Computer Security, vol. 14, pp. 343 - 360 2006.
[2]J. Rex Kelly Rainer, Charles A. Snyder ,Houston H. Carr "Risk analysis for information technology," Journal of Management Information Systems vol. 8, pp. 129 - 147, 1991.
[3]E. Y. L.L.P., "Global Information Security Survey," 2002.
[4]Q. J. Yeh and A. J. T. Chang, "Threats and countermeasures for information system security: A cross-industry study," Information & Management, vol. 44, pp. 480-491, Jul 2007.
[5]J. H. P. Eloff, L. Labuschagne, and K. P. Badenhorst, "A comparative framework for risk analysis methods," Computers & Security, vol. 12, pp. 597-603, 1993.
[6]H. K. Roman, ""Information Security" Dominates List for Fourth Consecutive Year," Infotech Update, vol. 15, p. 1, 2006.
[7]B. Jacques and S. Rossouw Von, "A cyclic approach to business continuity planning," Information Management & Computer Security, vol. 12, p. 328, 2004.
[8]A. Arnell, Handbook of Effective Disaster/Recovery Planning. New Yourk, NY: McGraw-Hill Pub. Co., 1990.
[9]C.-Q. Staff, Disaster Recovery: Contingency Planning & Program Evaluation Wellesley, Mass. : QED Information Sciences 1985.
[10]V. Cerullo and M. J. Cerullo, "Business continuity planning: A comprehensive approach," Information Systems Management, vol. 21, pp. 70-78, Sum 2004.
[11]W. Lam, "Ensuring business continuity," IT Professional, vol. 4, pp. 19-25, 2002.
[12]K. Nelson, "Examining Factors Associated with IT Disaster Preparedness," in 39th Hawii International Conference on System Sciences, Hawaii, 2006.
[13]M. Devargas, "Survival is not compulsory: An introduction to business continuity planning," Computers & Security, vol. 18, pp. 35-46, 1999.
[14]S. Smith and R. Jamieson, "Determining key factors in E-government information system security," Information Systems Management, vol. 23, pp. 23-32, Spr 2006.
[15]G. Dinnie, "The Second Annual Global Information Security Survey," Information Management & Computer Security, vol. 7, pp. 112-120, 1999.
[16]B. Herbane, D. Elliott, and E. M. Swartz, "Business Continuity Management: time for a strategic role?," Long Range Planning, vol. 37, pp. 435-457, 2004.
[17]S. Hinde, "Business continuity planning," Computer Audit Update, vol. 1997, pp. 2-5, 1997.
[18]M. Nemzow, "Business continuity Planning," International journal of network management, vol. 7, pp. 127-136, 1997.
[19]M. Smith and J. Sherwood, "Business Continuity Planning," Computers & Security, vol. 14, pp. 14-23, 1995.
[20]K. Hearnden, "Business continuity planning: Part 1 : Contemporary issues in corporate computing," Computer Audit Update, vol. 1995, pp. 3-10, 1995.
[21]K. Hearnden, "Business continuity planning: Part 2 : Quality issue in corporate computing," Computer Audit Update, vol. 1995, pp. 3-7, 1995.
[22]K. Hearnden, "Business continuity planning: Part 3 : Acknowledging the impact of computer down-sizing," Computer Audit Update, vol. 1995, pp. 3-9, 1995.
[23]K. Hearnden, "Business continuity planning: Part 4 : Establishing business priorities," Computer Audit Update, vol. 1995, pp. 3-13, 1995.
[24]"Business continuity research highlights problems," Computer Fraud & Security, vol. 2000, p. 3, 2000.
[25]J. Botha and R. V. Solms, "A cyclic approach to business continuity planning," information Management & Computer Security, vol. 12, pp. 328-337, 2004.
[26]G. M. Heng, "Developing a suitable business continuity planning methodology," Information Management & Computer Security., vol. 4, p. 11, 1996.
[27]T. Ito, H. Orikasa, and T. Yoshida, "Fujitsu''s business continuity plan development methodology," Fujitsu Scientific & Technical Journal, vol. 43, pp. 168-177, Apr 2007.
[28]M. E. Whitman and H. J. Mattord, Management of Information Security. United States Course Technology Press 2004.
[29]NIST, Contingency Planning Guide for Information Technology Systems: National Institute of Standards and Technology, 2002.
[30]R. Stanton, "Beyond disaster recovery: the benefits of business continuity," Computer Fraud & Security, vol. 2005, pp. 18-19, 2005.
[31]P. H. Rosenthal and G. Sheiniuk, "Business resumption planning: Exercising the disaster management team," Journal of Systems Management, vol. 44, p. 12, 1993.
[32]T. J. Paradine, "Business interruption insurance: a vital ingredient in your disaster recovery plan," Information Management & Computer Security vol. 3, pp. 9-17, 1995.
[33]K. Karakasidis, "A project planning process for business continuity," Information Management & Computer Security, vol. 5, pp. 72-78, 1997.
[34]C. Maslen, "“Testing the plan is more important than the plan itself”," Information Management & Computer Security, vol. 4, pp. 26 - 29, 1996.
[35]T. Ernest-Jones, "Business continuity strategy - the life line," Network Security, vol. 2005, pp. 5-9, 2005.
[36]AT&T and Cisco, "AT&T/Economist Intelligence Unit Business Continuity Survey," 2005.
[37]J. L. L. Brett and M. S. Koger, "Dispelling 10 common disaster recovery myths: Lessons learned from Hurricane Katrina and other disasters," J. Educ. Resour. Comput., vol. 6, p. 6, 2006.
[38]G. C. Thomas and D. Milena, "TRANSITIONING FROM DISASTER RECOVERY MANAGEMENT TO BUSINESS CONTINUITY MANAGEMENT," Internal Auditing, vol. 20, p. 21, 2005.
[39]W. S. Chow, "Success factors for IS disaster recovery planning in Hong Kong," Information Management & Computer Security, 2000.
[40]P. J. Rothstein, "Up and Running: How to Ensure Disaster Recovery," Datamation, vol. 34, p. 86, 1988.
[41]R. Rohde and J. Haskett, "Disaster recovery planning for academic computing centers," Communications of the ACM, vol. 33, pp. 652 - 657, 1990.
[42]S. Lee and S. Ross, "Disaster recovery planning for information systems," Information Resources Management Journal, vol. 8, p. 18, 1995.
[43]A. E. Hutt, S. Bosworth, and D. B. Hoyt, Computer Security Handbook, 2nd ed. New York: Macmillan, 1988.
[44]R. Snoyer and G. Fischer, Managing Microcomputer Security: Business One, Irwin 1993.
[45]B. K. Wong, J. A. Monaco, and C. L. Sellaro, "Disaster recovery planning: Suggestions to top management and information systems managers," Journal of Systems Management, vol. 45, p. 28, 1994.
[46]Karen D. Loch, Houston H. Carr, and M. E. Warkentin, "Threats to Information Systems: Today''s Reality, Yesterday''s Understanding " MIS Quarterly, vol. 16, pp. 173-186, 1992.
[47]B. B. SD Ryan, "Evaluating security threats in mainframe and client/server environments," Information & Management, vol. 32, pp. 137-146, 1997.
[48]A. Kankanhalli, H.-H. Teo, B. C. Y. Tan, and K.-K. Wei, "An integrative study of information systems security effectiveness," International Journal of Information Management, vol. 23, pp. 139-154, 2003.
[49]J.-F. Carvajal-Vión and M. García-Menéndez, "Business Continuity Controls in ISO 17799 and COBIT " UPGRADE, vol. 4, pp. 17-23, 2003.
[50]B. Jung, I. Han, and S. Lee, "Security threats to Internet: a Korean multi-industry investigation," Information & Management, vol. 38, pp. 487-498, 2001.
[51]T. L. Weems, "Business continuity planning-for the rest of us," in Disaster Recovery Journal, 1999.
[52]I. O. f. Standardization, ISO/IEC 17799: 2005, Information Technology-Security Techniques-Code of Practice for Information Security Management, 2005.
[53]T. L. Saaty, The Analytic Hierarchy Process. Pittsburgh: RWS Publications, 1980.
[54]T. L. Saaty, Decision Making with Dependence and Feedback: The Analytic Network Process. Pittsburgh: RWS Publications, 2001.
[55]S. Erdogmus, M. Kapanoglu, and E. Koc, "Evaluating high-tech alternatives by using analytic network process with BOCR and multiactors," Evaluation and Program Planning, vol. 28, pp. 391-399, 2005.
[56]T. L. Saaty and M. Takizawa, "Dependence and independence: From linear hierarchies to nonlinear networks," European Journal of Operational Research, vol. 26, pp. 229-237, 1986.
[57]K. Kameya et al., N., Miyagi, H., Taira, N., & Yamashita, K., "Multiple-criteria decision-making using sectional supermatrix. ," in International Technical Conference on Circuits/Systems, Computers and Communications, Thailand, 2002, pp. 838–840.
[58]J. Sarkis and R. P. Sundarraj, "Hub location at Digital Equipment Corporation: A comprehensive analysis of qualitative and quantitative factors," European Journal of Operational Research, vol. 137, pp. 336-347, 2002.
[59]F. X. Frei and P. T. Harker, "Measuring aggregate process performance using AHP," European Journal of Operational Research, vol. 116, pp. 436-442, 1999.
[60]R. J. Kuo, S. C. Chi, and S. S. Kao, "A decision support system for selecting convenience store location through integration of fuzzy AHP and artificial neural network," Computers in Industry, vol. 47, pp. 199-214, 2002.
[61]P. O. Kim, K. J. Lee, and B. W. Lee, "Selection of an optimal nuclear fuel cycle scenario by goal programming and the analytic hierarchy process," Annals of Nuclear Energy, vol. 26, pp. 449-460, 1999.
[62]H. Aras, S. Erdogmus, and E. Koc, "Multi-criteria selection for a wind observation station location using analytic hierarchy process," Renewable Energy, vol. 29, pp. 1383-1392, 2004.
[63]H. M. A. Fahmy, "Reliability evaluation in distributed computing environments using the AHP," Computer Networks, vol. 36, pp. 597-615, 2001.
[64]C. Gencer and D. Gurpinar, "Analytic network process in supplier selection: A case study in an electronic firm," Applied Mathematical Modelling, vol. 31, pp. 2475-2486, 2007.
[65]S.-H. Chung, A. H. I. Lee, and W. L. Pearn, "Analytic network process (ANP) approach for product mix planning in semiconductor fabricator," International Journal of Production Economics, vol. 96, pp. 15-36, 2005.
[66]T. L. Saaty, "Fundamentals of the Analytic Network Process," in ISAHP, Japan, 1999, pp. 12-14.
[67]Huang, Jih-Jeng, G.-H. Tzeng, and C.-S. Ong, "Multidimensional data in multidimensional scaling using the analytic network process," Pattern Recognition Letters vol. 26, pp. 755 - 767 2005.
[68]M. P. Niemira and T. L. Saaty, "An Analytic Network Process model for financial-crisis forecasting," International Journal of Forecasting, vol. 20, pp. 573-587, 2004.
[69]L. M. Meade and A. Presley, "R&D project selection using the analytic network process," IEEE Transactions on Engineering Management, vol. 49, pp. 59-66, 2002.
[70]F. Y. Partovi and R. A. Corredoira, "Quality function deployment for the good of soccer," European Journal of Operational Research, vol. 137, pp. 642-656, 2002.
[71]B. Wolfslehner, H. Vacik, and M. J. Lexer, "Application of the analytic network process in multi-criteria analysis of sustainable forest management," Forest Ecology and Management, vol. 207, pp. 157-170, 2005.
[72]W. Ho, "Integrated analytic hierarchy process and its applications - A literature review," European Journal of Operational Research, vol. 186, pp. 211-228, 2008.
[73]P. K. D. William Ho, Helen E. Higson "Multiple criteria decision-making techniques in higher education," International Journal of Educational Management, vol. 20, pp. 319 - 337, 2006.
[74]S. Mishra, S. G. Deshmukh, and P. Vrat, "Matching of technological forecasting technique to a technology," Technological Forecasting and Social Change, vol. 69, pp. 1-27, 2002.
[75]K. Kim, K. Park, and S. Seo, "A matrix approach for telecommunications technology selection," Computers & Industrial Engineering, vol. 33, pp. 833-836, 1997.
[76]J. W. Lee and S. H. Kim, "Using analytic network process and goal programming for interdependent information system project selection," Computers & Operations Research, vol. 27, pp. 367-382, 2000.
[77]J. A. Momoh and J. Z. Zhu, "Application of AHP/ANP to unit commitment in the deregulated power industry," in Systems, Man, and Cybernetics, 1998. 1998 IEEE International Conference on, 1998, pp. 817-822 vol.1.
[78]A. Presley and L. M. Meade, "Strategic allignment and IT investment selection using the analytic network process," in Americas Conference on information systems, Milwaukee WI, 1999.
[79]M. Torkkeli and M. Tuominen, "The contribution of technology selection to core competencies," International Journal of Production Economics, vol. 77, pp. 271-284, 2002.
[80]A. Kengpol, "The technology selection approach for group decision making in the evaluation of information technology," The Journal of KMITNB, vol. 12, 2002.
[81]L.-H. Chen and F.-C. Tsai, "Fuzzy goal programming with different importance and priorities," European Journal of Operational Research, vol. 133, pp. 548-556, 2001.
[82]M. Arenas Parra, A. Bilbao Terol, and M. V. Rodriguez Uria, "A fuzzy goal programming approach to portfolio selection," European Journal of Operational Research, vol. 133, pp. 287-297, 2001.
[83]R. Narasimhan, "Goal Programming in a Fuzzy Environment," Decision Sciences, vol. 11, p. 325, 1980.
[84]R. N. Tiwari, S. Dharmar, and J. R. Rao, "Fuzzy goal programming -- An additive model," Fuzzy Sets and Systems, vol. 24, pp. 27-34, 1987.
[85]E. L. Hannan, "Linear programming with multiple fuzzy goals," Fuzzy Sets and Systems, vol. 6, pp. 235-248, 1981.
[86]T. Yang, J. P. Ignizio, and H.-J. Kim, "Fuzzy programming with nonlinear membership functions: piecewise linear approximation," Fuzzy Sets and Systems vol. 41, pp. 39 - 53 1991.
[87]E. L. Hannan, "On Fuzzy Goal Programming," Decision Sciences, vol. 12, p. 522, 1981.
[88]M. Kumar, P. Vrat, and R. Shankar, "A fuzzy goal programming approach for vendor selection problem in a supply chain," Computers & Industrial Engineering, vol. 46, pp. 69-85, 2004.
[89]A. Biswas and B. B. Pal, "Application of fuzzy goal programming technique to land use planning in agricultural system," Omega, vol. 33, pp. 391-398, 2005.
[90]W. F. Abd El-Wahed and S. M. Lee, "Interactive fuzzy goal programming for multi-objective transportation problems," Omega, vol. 34, pp. 158-166, 2006.
[91]F. Arikan and Z. Gungor, "An application of fuzzy goal programming to a multiobjective project network problem," Fuzzy Sets and Systems, vol. 119, pp. 49-58, 2001.
[92]T. L. Saaty and K. P. Kearns, Analytical Planning: The Organization of Systems: Pergamon, 1985.
[93]L. Bodin and S. I. Gass, "On teaching the analytic hierarchy process," Computers & Operations Research, vol. 30, pp. 1487-1497, 2003.
[94]A. M. Cox, J. Alwang, and T. G. Johnson, "Local Preferences for Economic Development Outcomes: Analytical Hierarchy Procedure," Growth & Change, vol. 31, p. 341, Summer 2000.
[95]K. Soma, "How to involve stakeholders in fisheries management--a country case study in Trinidad and Tobago," Marine Policy, vol. 27, pp. 47-58, 2003.
[96]E. Jordan, "IT contingency planning: management roles," Information Management & Computer Security, vol. 7, pp. 232 - 238, 1999.
[97]K.-M. Bryson, H. Millar, A. Joseph, and A. Mobolurin, "Using formal MS/OR modeling to support disaster recovery planning," European Journal of Operational Research, vol. 141, pp. 679-688, 2002.