隨著國內法令規範對於隱私政策更加重視，國內外企業組織因應鉅額罰款與政策的施行，再加上個人資料外洩事件頻傳，各企業無不擔心客戶資料的保護與落實內部資料控制。而大型政府機關或企業，由於服務範圍廣大，應用系統繁多，針對資料外洩的保護與落實，將更加的複雜。大部份的組織針對實體文件、安全性儲存設備管制、使用採購防火牆設備等，皆有進行相關的管理與設備的採購，但上述機制未能解決應用系統的資料外洩問題。對稽核人員而言稽查應用程式是否有資料外洩之虞，由應用程式原始程式碼相當實為不易，而新制定一套更安全存取控管的介面更需投入相當高的成本與時間。

本研究在設計與實作資料外洩稽核工具，參考國際標準ISO27002與ISO 13569資訊安全作法，摘選出應用系統資訊安全指引，並根據實務經驗與金融產業的系統特性，找出資料外洩存取規則(Rules)。除此之外需搭配資料庫執行指令記錄器(DB Logger)，由大量的資料庫指令紀錄中快速產生稽核報表，藉以協助稽核人員查核資料外洩的線索並督促組織內部問題的改善，以落實內部資料控管政策與外部法令要求。

The rapid spread of information technologies into every facet of our life results in a surge in attention to privacy recently. Bills are enacted and a comprehensive privacy policy becomes a sign of a responsible corporation. However, the complexity and diversity of application systems of information makes it very difficult to ensure that the information systems conform to all the privacy regulations and polices. Although most corporations have established some privacy policies for controlling physical documents and various hardware devices, the main problem for data leakage is at application layer. Application developers could retrieve sensitive data by exploiting application flaws. This poses great challenges to information system auditors. Firstly, it is rather difficult for auditors to review the code to spot the flaws. Secondly, it is impractical to make a new coding standard and re-write the legacy applications accordingly. Thirdly, application developers lack the motivation to improve the protection level of existing systems.

This thesis argues that a database audit tool can partly address the above difficulties faced by auditors. Specifically, we design and implement a tool for data leakage auditing. We derive right rules for identifying the potential sources of data leakage by referencing to information security practices such as ISO27002 and ISO 13569, and our practical experience in financial industry. Our tool makes good use of the database logger to produce an audit report based on those rules. The audit reports provide not only useful hints for auditors to detect possible data leakage, but also good evidence for urging developers to enhance their applications for privacy protection.

【1】 個人資料保護法, 行政院, 2008
【2】 CNS 17799－資訊安全管理之作業要點, 經濟部標準檢驗局, 2002
【3】 ISO-IEC 27002 Information technology- Security techniques- Code of practice for information security management, ISO, 2005
【4】 ISO/TR 13569 Banking and related financial services — Information security guidelines, ISO, 2003
【5】 More Than Half of Ex-Employees Admit to Stealing Company Data According to New Study, http://www.symantec.com/about/news/release/article.jsp?prid=20090223_01
【6】 Introducing SQL Server Profiler, http://msdn.microsoft.com/en-us/library/ms181091.aspx
【7】 RadControls for ASP.NET AJAX, http://www.telerik.com/help/aspnet-ajax/introduction.html
【8】 Role-based access control,
http://en.wikipedia.org/wiki/Role-based_access_control
【9】 AJAX,
http://zh.wikipedia.org/wiki/AJAX
【10】 Avoid The SQL Injection,
http://www.microsoft.com/taiwan/sql/SQL_Injection.htm
【11】 SQL Injection,
http://en.wikipedia.org/wiki/SQL_injection
【12】 Injection Flaws,
http://www.owasp.org/index.php/Injection_Flaws
【13】 OWASP Top 10 Project,
http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
【14】 SQL Server Books online,
http://msdn.microsoft.com/en-us/library/ms130214.aspx
【15】 IS Standards, Guidelines and Procedures for Auditing and Control Professionals, ISACA, 2008