從組織學習理論觀點探討組織資訊安全外包的意圖

Abstract

近年來，雖然資訊安全攻擊數量快速提升，公司卻沒有擁有足夠受過良好訓練的資訊安全人才。為改善資訊安全的管理，越來越多公司採用或考慮資訊安全外包，藉由資訊安全服務供應商的防護及管理，來提升公司資訊安全管理的品質。資訊安全外包也漸漸受到學者重視，然而，多數文獻是從以往探討外包意圖的經濟理論觀點來做探討，但公司不該只單從外包獲取經濟上的利益，還需要藉此機會提升自己的學習能力，才能在風險較高的資訊安全外包合作關係下，順利完成所有任務。因此，我們採用組織學習理論為基礎，發展適合的模型來研究採用資訊安全外包的意圖。收集資料驗證此模型的假設，結果顯示在與資訊安全服務提供商合作的期間，公司的確有明顯的學習過程，進而提升公司的能力和與外界合作的信心。

The number of information security attacks has been increasing rapidly these days. However, most organizations do not have enough well-trained information security professionals, because of the security talent shortage. To improve information security management, more and more firms adopted or considered information security outsourcing. Under the protection and the control by managed security service providers (MSSP), firms relieved stress from security attacks. Besides, MSS gradually draws attention from scholars. Most literature analyzed the intention to outsource from economic perspective. Even though most firms generated benefits from production cost advantages, they should learn from providers to improve their own capabilities. Therefore, based on organizational learning theory, we constructed a model to analyze the intention to outsource information security management to MSSP. The result showed that learning processes occurred during the cooperation. Firm improved their learning capabilities and had more confidence to cooperate with other firms in the future.