供应链信息安全现状及体系框架研究

本文研究了我国供应链目前普遍存在的信息安全问题,如:企业员工的信息安全意识淡薄;信息安全管理有章不循现象普遍;缺乏统一的信息安全战略规划和防范机制;合作企业间存在逆向选择风险和各种败德行为等。针对上述问题,参考众多企业积累的经验,吸取了供应链信息安全领域的最新理论研究成果,提出了供应链信息安全体系框架。该框架由信息安全治理、信息安全管理、基础安全服务和架构、第三方信息安全服务与认证机构和供应链信息安全技术标准体系五个部分构成。在具体运用中从供应链整体业务需求出发,参照供应链信息安全体系框架,通过评估和风险分析等方法,定义供应链及其节点企业安全需求,并最终确定供应链信息安全建设的内容和方向。

Research on Information Security Framework of Supply Chain

The paper study some common issues of information security in our supply chain, such as employees is consciousness of information security, information security management do not follow the principle, lack of a u- nified planning of information security strategic and mechanism of prevention, adverse selection and moral hazard exists between cooperation enterprises. Address these issues, and reference experience of enterprises accumulated, and absorb the latest theoretical studies of information security in supply chain, then propose a information security framework in supply chain. The framework consists of enterprise information security governance, enterprise infor- mation security management, infrastructure security services and architecture, third-party information security ser- vices and certification authority and information security technology standard system of supply chain.