近年來幾個大型的資安事件不斷，造成企業巨大的損失，由於資訊安全工作會耗費企業龐大的資金與人力，但百分之九十以上的產業研究機構（如Gartner Group、Yankee Group、IDC）都審慎樂觀看好網路保全未來之發展，國內企業及政府機關也已開始注意資訊安全方面的議題，業者也陸續投入網路保全市場，由於目前企業及政府機關對網路保全的認知和業者差距太大，亦無相關的法令規章加以規範，以及政府也不知應如何配合建置產業環境來協助業者發展，以致於市場一直拓展不開來。

為了讓國內企業及政府機關都能享受一個安全的網路環境，本研究從政府、網路保全業者、客戶及雙方關係的協議書的角度進行深入的探討，簡述如下，以提供政府、網路保全業者及客戶相關的建議，以期對網路保全產業有所助益。

從政府的角度來看：網路保全雖處於萌芽階段，但越來越多網路保全業者投入，政府應站在輔導的立場，建構一完整的產業環境及應訂定法律來規範產業的秩序。

從網路保全業者的角度來看：經本研究探討得知能提供滿足客戶所有服務需求能力及自身所須知核心條件的網路保全業者，才可得到客戶的信賴。

從客戶的角度來看：經本研究探討得知如何選擇一適當的業者是網路保全服務委外成功及降低網路保全服務可能移轉失敗的關鍵性因素。而且，服務委外之前對可能存在的風險，作一審慎的評估也是必要的。

最後，SLAs 是保護客戶權益及降低風險最重要的文件，因此，經本研究探討得知客戶需配合本身產業的特性審慎決定服務的需求，並經過協商後要求業者做出最後的承諾，如此客戶才能獲得真正的保障。

Recently, the continuously huge events about computer security have brought the large corporations heavy loss. Hence, more than 90 percent of productivity research institutes (such as Gartnes Group, Yankee Group, IDC) cautiously, positively and optically look forward to the coming development of MSSP (Managed Security Service Provider). In addition, local companies and the government decide to pay much attention to the aspects of MSS. Thirdly, the MSSP make efforts to widen the network security market. Unfortunately, this market is not able to increase nationally as we have predicted. The main factors are:
1. The big difference of know-how between the enterprises, government and the MSSP.
2. No related regulations to be followed thus the government does not know how to assist the MSSP with proper methods.

From the government’s point: Though the MSS (Managed Security Service) is just in the starting point, more and more MSSP, in fact, have been costly investing the development and marketing so as to establish a fully safe computer uses. Under this condition, the government should play an important role to assist and upgrade the manufactories with the experienced security companies.

From MSSP’s point: This study shows that only the MSSP which can provide satisfactory services and exact demands, are able to win the customers’ trust.

From the customers’ point: This document discusses the strategies to choose an appropriate MSSP that serves well, reduces the failure of transferring as well as anticipates and prevents the potential risks those the customer may face.

The last, SLAs are the most important document to protect the customer’s benifit and minimize the probable damage. Hence, first the serving items must cooperate with the characteristics of the customer’s products. Second final well-planned implementation should be handed to the customer by the MSSP after mutual negotiation.

中文部分
1. 王凱，「資訊安全市場發展現況與趨勢」，IT Security研討會，2003/3/26。
2. 高永昆，「保全業與大樓管理業經營事務項目之區別」，1999。
3. 許春金、李湧清、郭志裕，「台灣保全業型態、基本原理與未來發展趨勢之探討」，中央警官學校警政研究所，1995。
4. 莊雅真，「如何為電腦機房建構完善的消防安全系統」，資安人，第3期，頁126-129，2003。
5. 曾文德，「資訊安全委外服務研究（MSSP篇）」，資訊與電腦，第269期，頁33-38，2002/12。
6. 虞金燕，「資訊安全發展趨勢與科專研發方向建議」，財團法人資訊工業策進會 資訊市場情報中心（MIC），2001/12。
7. 潘時超，「我國資通安全市場發展現況與趨勢」，財團法人資訊工業策進會 資訊市場情報中心（MIC），2002。
8. 鄭文竹，「駐衛保全市場區隔之探討」，警學叢刊，頁139-156，2003/1。
9. 賴溪松、葉青斌，「資訊安全入門」，全華，頁129,132，139-42，2001/6。
10. 鍾翠玲，「資安走向整合服務，廠商深化合作」，CNET電子報Taiwan.NET.Com，2002/12/12。
11. 羅儀萍，「保全產業回顧與展望--杜絕惡性競爭 採取策略聯盟經營」，安全&自動化，第46期，頁113-117，2001/12-2002/1。
12. 「保全業市場現況與未來展望」，安全&自動化，第44期，頁31-35，2001/8-9。
13. 保全業法，2003/1/22修正。
14. 保全業法施行細則，1999/11/20修正。
15. 勞動基準法及施行細則，1998。
16. 中興保全九十年度年報，2002/5/31，頁1, 9-14
17. 新光保全九十年度年報，2002/5/31，頁3-5, 14-20
18. 「資安防衛調查」，InfoWorld，2002。
19. 「精挑優質MSSP」，ComputerWorld，2002/9/29。
20. 台北市保全商業同業公會網站，http://www.sca.org.tw/
21. 新光保全 安全網，http://www.sks.com.tw/04.htm。
22. 資通安全區域聯防中心，http://www.sss.org.tw/。

英文部分
1. A. Dang Van Mien, K. Parveen “European MSSPs Value Trusted Relationships Not Just Technology” Gartner Commentary, 18 March 2003.
2. Alner, Marie. “ The Effects of Outsourcing on Information Security.”， Information Systems Security. Auerbach Publications, CRC Press LLC, May/June 2001.
3. Ambrose,C.”IT Service Contracts-Transition and Transformation Plan.” Gartner
4. BITS Framework: Managing Technology Risk for Information Technology (IT) Service Provider Relationships, Version 3.2a. BITS IT Service Providers Working Group, October, 2001. Available at http://www.bitsinfo.org/FrameworkVer32.doc.
5. “CISCO AVVID(Architecture for Voice, Video, and Integrated Data) Partner Program – Security and VPN Services: Partner Verification Request for Information(RFI).” CISCO Systems, Inc., 2001. Information about the Partner Program is available at http://www.cisco.com/warp/public/779/largeent/partner/esap/secvpn.html.
6. Hiles, Andrew. The Complete Guide to IT Service Level Agreement: Aligning IT Service to Business Needs, Third Edition. Rothstein Associates Inc., Brookfield, CN, 2002. Ordering information is available at http://www.servicelevelbooks.com.
7. Internet Security Systems. “How to Select a Managed Security Provider.” April,2001. Available at http://www.iss.net/support/documentation/whitepapers/market.php.
8. J.Pescatore, K.Kavanagh “North American MSSP Magic Quadrant 2H02” Gartner Commentary, 23 January 2003.
9. Navarro, Luis. “Information Security Risks and Managed Security Service.” Information Security Technical Report, Vol 6, No. 3, Elsevier,2001.
10. Nicolett, M., Matlus, R. “SLAs With Outsourcers May Provide Less ThanYou Realize.” Gartner Commentary, 21 January 2002.
11. Ott, Jeffrey L.“ Managed Security Services.” Information System Security, Vol10, No 4, September/October 2001.
12. Radcliff, Deborah. “Sizing Up Security Services.” Computerworld, Nov 27, 2000. Available at hppt://www.computerworld.com/cwi/story/0,1199,NAV47_STO54345,00.html.
13. Richard Stiennon “Tutorial：Internet Security 101” Gartner Symposium ITxpo, 6-11 October 2002.
14. Wilbanks, Joan. “Outsourcing Internet Security:The Life You Save May Be Your Company’s.”Information System Security.Auerbach Publications,CRC Press LLC,May 2001
15. DeJesus, Edmund. “Managing Managed Security.” Information SecurityMagazine, January, 2001. Available at http://www.infosecuritymag.com/articles/january01/cover.shtml,Commentary, 14 September 2001
16. Hulme, George. “Security’s Best Friend.” InternetWeek, July 13, 2001. Available at http://www.informationweek.com/story/IWK20010713S000
17. Network Magazine India. “Crafting the Service Level Agreement ”，IndiaExpress Group, 2001. Available at http://www.networkmagazineindia.com/200111/focus1.htm
18. Ubizen: Managed Security Services white paper,Service Provider Relationships，BITS IT Service Providers Working Group，October，2001。Available at http://www.bitinfo.org/FrameworkVer32.doc
19. “Change Without Pain – An Alternative Model for Year One of Outsourcing Agreements.” SourceNet Solutions. Available at http://www.sourcenetsolutions.com/publications/download/outsourcing_center_white_paper.pdf.