臺灣博碩士論文加值系統

行動設備日益普及，自攜設備(Bring Your Own Device, BYOD)議題逐漸受到重視，BYOD代表了企業行動模式的新階段，將有可能改變人們和企業未來的工作方式。在享有BYOD許多優勢的同時，其特性也帶來了不同以往的安全議題，而這些議題也是目前阻礙國內外企業採用BYOD政策之主因，因此BYOD環境下需要擁有一個方法能迅速且全面地進行安全威脅之識別。本研究之研究目的有三點：（一）、將現有的BYOD安全威脅和風險進行彙整與分類；（二）、設計一個適用於BYOD環境下的安全模型；（三）、此模型能給予BYOD環境不同角色進行威脅識別。本研究所設計之模型由三個構面所組成，用以分析本研究彙整之三十九項BYOD安全威脅，並使用德菲法(Delphi Method)整合群體專家的意見，將BYOD安全威脅分類之各項目放置於模型中之對應位置，經過數次意見往返，確定了最終模型三大構面的各個面向和風險對應位置。此模型可依照使用者之需求提供安全威脅檢查清單進行威脅識別與查核，企業管理者可以利用本研究了解BYOD所衍伸之風險，審慎評估員工、設備及企業內部網路之安全性，輔以實行適合企業文化之安全政策或解決方案；資訊安全人員與一般員工也可以透過本研究識別企業實行BYOD政策時將會面臨哪些資訊安全或隱私性之風險。

With the popularity of mobile devices, the issue of BYOD (Bring Your Own Device) becomes more and more important. BYOD stands for a new stage of enterprise mobile mode, and it will be able to change the working ways of people and enterprises in the future. Because of the characteristics of BYOD, it not only has many advantages, but also brings some security problems which differ from the past. These security problems are also the main reason that obstructs enterprises all over the world to apply BYOD policy. Therefore, we need a method to identify security threats rapidly and comprehensively in BYOD environment.
This research has three objectives: 1. Aggregate and classify existing BYOD security threats and risks; 2. Design a security model which is suitable in BYOD environment; 3. Let different roles in a company to identify security threats by using the proposed security model. The proposed security model contains three dimensions, and it is used to analyze 39 BYOD security threats aggregated by this research. First of all, Delphi Method is used to integrate opinions of experts. Then, BYOD security threats are matched to the corresponding positions in the model. Finally, after two rounds of opinions back and forth, the aspects of three dimensions and the corresponding positions of security threats are determined. According to the requirements of users, the proposed model can provide security threat checking list to identify and check threats. Via the results of this research, enterprise managers can realize the risks of BYOD, evaluate the security of employee, equipment and internal network carefully, and carry out the security policy or solutions which are suitable to enterprise culture. Furthermore, information security staffs and employees can identify the information security and privacy risks according to enterprise’s BYOD policy.

目次
指導教授推薦書
口試委員會審定書
誌謝 iii
摘要 iv
Abstract v
目次 vii
圖目次 x
表目次 xi
第一章 緒論 1
1.1研究背景 1
1.2研究動機 3
1.3研究目的 4
第二章 文獻探討 5
2.1 BYOD介紹 5
2.2 BYOD風險與威脅 6
2.2.1 行動設備的安全挑戰 7
2.2.2 行動設備威脅和攻擊 12
2.3 BYOD現有解決方案 13
2.3.1 行動設備管理(MDM) 13
2.3.2 行動應用程式管理(MAM) 15
2.3.3 桌面和應用程式的虛擬化 (Virtualization) 15
2.4 已提出之資訊安全模型回顧 18
2.4.1 McCumber Information System Security Model 18
2.4.2 Security Model for Cloud Computing Environment 18
2.4.3 Security Guidance for Critical Areas of Focus in Cloud Computing V2.1 20
2.5 ISO 27001 21
第三章 研究方法與設計 23
3.1 問題與需求描述 23
3.2 BYOD安全威脅分類 24
3.3 模型架構設計 34
3.3.1 構面選擇之原因 36
3.3.2 資訊安全控制領域 36
3.3.3 資訊安全需求 40
3.3.4 組成元件 43
3.4 BYOD安全威脅對應位置 46
3.4.1 流程說明 47
3.4.2 收斂結果分析 49
3.4.3 討論 63
第四章 安全模型之情境分析 66
4.1 模型適用對象 66
4.2 情境應用 67
4.2.1 企業管理者之情境應用 68
4.2.2 資訊人員之情境 71
4.2.3 員工之情境 72
第五章 結論與未來研究方向 73
5.1 結論 73
5.2 研究貢獻 74
5.3 研究限制 75
5.4 未來研究方向 76
參考文獻 77
附錄 82
附錄A BYOD第一回合安全威脅對應表格 82
附錄B BYOD第二回合安全威脅對應表格 92
附錄C BYOD安全威脅二維對應表 102



圖目次
圖1-1 行動設備安全性威脅 2
圖2-1 行動安全挑戰 6
圖2-2 BYOD挑戰 6
圖2-3 MDM架構圖 14
圖2-4 終端使用者運算的通用模型 16
圖2-5 終端使用者運算的四種模型 17
圖2-6 McCumber資訊系統安全模型 18
圖2-7 雲端安全模型構面組成示意圖 19
圖2-8 雲端模型、安全控制模型與遵循模型對應圖 20
圖2-9 ISO新舊版本控制領域及措施之比較 21
圖3-1 BYOD安全模型構面組成示意圖 34
圖3-2 資訊安全控制領域示意圖 37
圖3-3 資訊安全需求示意圖 41
圖3-4 組成元件示意圖 44
圖3-5 本研究欲透過德菲法之實施步驟 46
圖3-6 資訊安全控制領域收斂示意圖 49
圖4-1 BYOD安全模型運作流程示意圖 67
圖4-2 系統初始畫面 68
圖4-3 面向選擇之畫面 69
圖4-4 總檢查清單之產生-企業管理者情境 70



表目次
表2-1 行動設備常見之攻擊 12
表3-1 BYOD安全威脅分類 24
表3-2 安全模型各構面之面向 35
表3-3 構面共識比例之計算 52
表3-4 BYOD安全威脅對應表─資訊安全控制領域 54
表3-5 BYOD安全威脅對應表─資訊安全需求 57
表3-6 BYOD安全威脅對應表─組成元件 60
表A-1 第一回合BYOD安全威脅對應表-資訊安全控制領域 82
表A-2 第一回合BYOD安全威脅對應表-資訊安全需求 86
表A-3 第一回合BYOD安全威脅對應表-組成元件 89
表B-1 第二回合BYOD安全威脅對應表-資訊安全控制領域 92
表B-2 第二回合BYOD安全威脅對應表-資訊安全需求 96
表B-3 第二回合BYOD安全威脅對應表-組成元件 99
表C-1 BYOD安全威脅對應表-資訊安全控制領域與資訊安全需求 102
表C-2 BYOD安全威脅對應表-資訊安全控制領域與組成元件 105
表C-3 BYOD安全威脅對應表-資訊安全需求與組成元件 108

[1] Adibi, S., “Comparative Mobile Platforms Security Solutions,” 2014 IEEE 27th Canadian Conference of Electrical and Computer Engineering (CCECE), pp. 1-6, 2014.
[2] BSI, “Information Technology-Security Techniques-Code of Practice for Information Security Management,” ISO/IEC 27002:2005, 2005.
[3] BSI, “Information Technology-Security Techniques-Information Security Management Systems-Requirements,” ISO/IEC 27001:2013, 2013.
[4] Certified Ethical Hacker., “Hacking Mobile Platforms,” Ethical Hacking and Countermeasures, Exam 312-50, Module 16.
[5] Chang, J. M., Ho, P. C., &; Chang, T. C., “Securing BYOD,” IEEE IT Professional, Vol. 16, No. 5, pp. 9-11, 2014.
[6] Cloud Security Alliance, “Security Guidance for Critical Areas of Focus in Cloud Computing V2.1,”
https://cloudsecurityalliance.org/csaguide.pdf, Accessed on Jun 2015.
[7] Ding, J. H., Chien, R., Hung, S. H., Lin, Y. L., Kuo, C. Y., Hsu, C. H., &; Chung, Y. C., “A Framework of Cloud-based Virtual Phones for Secure Intelligent Information Management,” International Journal of Information Management, Vol. 34, No. 3, pp. 329-335, 2014.
[8] Eslahi, M., Naseri, M. V., Hashim, H., Tahir, N. M., &; Saad, E. H. M., “BYOD: Current State and Security Challenges,” IEEE Symposium on Computer Applications &; Industrial Electronics (ISCAIE), pp. 189-192, 2014.
[9] Han, D., Zhang, C., Fan, X., Hindle, A., Wong, K., &; Stroulia, E., “Understanding Android Fragmentation with Topic Analysis of Vendor-Specific Bugs,” 2012 19th IEEE Working Conference on Reverse Engineering (WCRE), pp. 83-92, 2012.
[10] Hess, K., “How to Evaluate Mobile Management Solutions,” Tom’s IT PRO,
http://www.tomsitpro.com/articles/evaluating-mobile-management-solutions,2-708-2.html, Accessed on Jun 2014.
[11] ISO, “Information Processing Systems-Open Systems Interconnection-Basic Reference Model -Part 2: Security Architecture,” ISO 7498-2:1989, 1989.
[12] John, M., "Information Systems Security: A Comprehensive Model," Proceedings of the 14th National Computer Security Conference, 1991.
[13] Juniper Networks Global Threat Center, “2014 malicious mobile threats report,”
http://www.juniper.net/us/en/local/pdf/additional-resources/jnpr-2011-mobile-threats-report.pdf, Accessed on Jun 2014.
[14] Juniper Networks, “2012 Mobile Threats Report,” 2013.
[15] Kim, K. J., &; Hong, S. P., “Study on Enhancing Vulnerability Evaluations for BYOD Security,” International Journal of Security and Its Applications, Vol. 8, No. 4, pp. 229-238, 2014.
[16] Microsoft Library, “MDM System Overview,”
http://technet.microsoft.com/en-us/library/cc135589(TechNet.10).aspx
,2008, Accessed on Jun 2014.
[17] Miller, K. W., Voas, J., &; Hurlburt, G. F., “BYOD: Security and Privacy Considerations,” IT Professional, Vol. 14, No. 5, pp. 53-55, 2012.
[18] Morrow, B., “BYOD Security Challenges: Control and Protect your Most Sensitive Data,” Network Security, Vol. 2012, No. 12, pp. 5-8, 2012.
[19] Park, W. H., Kim, D. H., Kim, M. S., &; Park, N., “A Study on Trend and Detection Technology for Cyber Threats in Mobile Environment,” 2013 International Conference on IT Convergence and Security (ICITCS), pp. 1-4, 2013.
[20] Pilz, H., &; Schindler, S., “Are Free Android Virus Scanners Any Good,” AV-TEST Report, 2011.
[21] Romer, H., “Best Practices for BYOD Security,” Computer Fraud &; Security, Vol. 2014, No. 1, pp. 13-15, 2014.
[22] Samaras, V., Daskapan, S., Ahmad, R., &; Ray, S. K. “An Enterprise Security Architecture for Accessing SaaS Cloud Services with BYOD,” Australasian Telecommunication Networks and Applications Conference, pp. 129-134,2015.
[23] Scarfo, A., “New Security Perspectives Around BYOD,” Proceedings of the 2012 7th International Conference on Broadband, Wireless Computing, Communication and Applications, pp. 446-451, 2012.
[24] Symantec, “2011 Internet Security Threat Report,” www.symantec.com/threatreport , 2012, Accessed Nov 2012.
[25] Titze, D., Stephanow, P., &; Schutte, J., “A Configurable and Extensible Security Service Architecture for Smartphones,” 2013 27th International Conference on Advanced Information Networking and Applications Workshops (WAINA), pp. 1056-1062, 2013.
[26] Tse, D. W. K., “A New Smartphone Privacy Protection Scheme based on Anti-theft Technology,”Computer Audit Association, No. 30 ,2014
[27] Wagenseil, P., “Half of Used Cellphones Still Hold Personal Data,” NBC News, 2011.
[28] Wang, Y., Wei, J., &; Vangury, K., “Bring Your Own Device Security issues and challenges,” IEEE 11th Consumer Communications and Networking Conference (CCNC), pp. 80-85, 2014.
[29] Wikipedia, “Consumerization,”
http://en.wikipedia.org/wiki/Consumerization , Accessed on Oct 2014.
[30] Zhou, Y., &; Jiang, X., “Dissecting Android Malware: Characterization and Evolution,” 2012 IEEE Symposium on Security and Privacy (SP), pp.95-109, 2012.
[31] IThome，「TLS加密協定竟然也不安全！企業須審慎內部漏洞」，http://www.ithome.com.tw/promotion/93094，民國103年。
[32] IThome，「推動BYOD的三大安全控管做法」，http://www.ithome.com.tw/node/73587，民國101年。
[33] 互動百科，「MAM」，http://www.baike.com/wiki/MAM，於民國104年1月檢索。
[34] 企業網D1net，「BYOD安全選什麼？MDM還是MAM」，http://www.d1net.com/byod/mdm/249039.html，民國102年。
[35] 洪羿漣(2014)，Net Admin網管人，「涵蓋裝置、應用與內容管理行動安全兼顧隱私」，http://www.netadmin.com.tw/article_content.aspx?sn=1403050002，民國103年。
[36] 陳朝麟，「適用於雲端運算環境下之安全模型」，長庚大學資訊管理學系碩士論文，民國100年。
[37] 張文瀞，「ISO27001:2013和ISO27001:2005的主要差異」， http://www.cc.ntu.edu.tw/chinese/epaper/0030/20140920_3003.html，於民國104年6月檢索。
[38] 黃金月，「ISO 27001資訊安全簡介」，http://wiki.cc.ncu.edu.tw/mediawiki/images/4/4a/ISO_27001資訊安全簡介_991111.pdf，於民國104年6月檢索。
[39] 戴智啟，「行政機關國會聯絡人工作績效評估指標建構之研究」，。國立政治大學學校行政碩士在職專班碩士論文，民國97年。