Information Security Management
Information Security Risk Management Framework
The Information Department is responsible for coordinating information security and related matters, drawing up relevant internal control procedures and management, and regularly conducting internal information security inspections.
Information Security Policy
To build a safe and reliable information operation environment for the company, maintain the continuous operation of the business, reduce the risk of information operation, and protect the rights and interests of information service users, Information Security Policy is as follows:
1. Establish an information security management system to maintain the confidentiality, integrity, and availability of enterprise information assets.
2. Establish a safe and reliable information-based working environment to ensure the security of the Company's data, systems, equipment, networks, and information business services to ensure the sustainable operation of the Company's business.
3. Ensure that the information is accessible to authorized personnel to ensure its confidentiality.
4. Avoid unauthorized modification to ensure its correctness and integrity.
5. Ensure that the implementation of various business services must comply with the regulations and requirements of government authorities, stakeholders, or information and communication security organizations.
Specific Management Methods
In recent years, the company has actively strengthened the company's overall information structure, and specifically carried out a number of information security enhancement projects, including:
1. Strengthen Internal and External Network Security
(1) Use first-line brand next-generation firewalls for network segment isolation and protection
(2) Use an external information security monitoring system to observe whether there are loopholes at any time
(3) Import IP/MAC management system to strengthen the monitoring mechanism of external network equipment
2. Strengthen Endpoint Security
(1) Windows is updated regularly
(2) Import endpoint management and control system management
(3) Deploy well-known anti-virus software protection
3. Data Leakage Protection
(1) Establish an encryption mechanism for electronic files
(2) USB storage device management and control
(3) User authority classification
4. Email Security
(1) Spam, virus or phishing email blocking
(2) Establish a mail storage mechanism
5. Enhance IT Infrastructure
(1) Establish an off-site data backup mechanism
(2) Server and network cluster architecture establishment
In addition to the above information security enhancement projects, the company implements various established information policies. This includes participating in various information security seminars every year to learn about the latest information security issues, trends and related enhancement measures, and through regular internal announcements. They also plan social engineering drills and other preventive measures to enhance the information security awareness of all employees.
