隨著金融科技的發展，各金融機構加深了對資訊系統的依賴。面對日益高漲的資安威脅，各金融機也越來越重視資訊安全。其中，確保資訊系統符合資安規範，就成為非常重要的議題。也因此，近年各金融機構資訊單位開始研究如何建構符合資訊安全規範的系統環境，而開始陸續導入有效安全的更新管理機制，以確保系統軟體能持續進行修補，而達成資安合規目標。然而，在日趨龐大且複雜的系統環境架構下，如何持續進行軟體更新修補與符合資安合規檢測，是近來金融機構維運團隊面對的一大難題。
本研究以個案方式研究，蒐集分析個案機構在系統環境不斷增加時，如何面對更新管理問題，以及實施更新管理機制後的預期效益，提出一套有效規劃的更新管理機制，使系統環境在快速部署同時能持續獲得安全保障。

With the advance of financial technology, financial institutions become more and more relying on information systems and facing more and more security threats. Therefore, information security become more and more important to financial institutions. Ensuring information systems to follow system security best practices is one of major information security requirements for financial institutions. Consequently, financial institutions have begun to improve their patch management systems to ensure that the information systems in financial institutions can be continuously patched or hardened for comply associated security best practices. However, under the increasingly large and complex system environment architecture, it is a challenge to continuously perform system patching and compliance checking.
To address the issue, this study adopts the case study approach and discusses how a major Taiwanese financial institute addresses the patch management issues. This study collects the issues while the institute implements her patch management system and shows how the institute faces the issues. In addition, this study analyzes the results of patch management system implementation. Based on the results, this study illustrates that standardization plays an important role in implementing patch management systems. Therefore, this study can hopefully contribute to provide experience for other Taiwanese financial institutes to implement patch management systems.

[1] [online] Cormier, P. (2022, February 22). The State of Enterprise Open Source: A Red Hat Report. RedHat. [access on 2022.7.25]: https://www.redhat.com/en/resources/state-of-enterprise-open-source-report-2022
[2] [online]楊仁達. (2022, March 31). 產業必備的「開源軟體」恐成資安漏洞！問題到底出在哪？. 數位時代. [access on 2022.7.25]: https://www.bnext.ccom.tw/article/68379/inform-security-of-oss
[3] [online] 資安人編輯部. (2021, December 21). 合規性與安全漏洞：開源軟體資安如何補強. 資安人. [access on 2022.7.25]: https:// www.informationsecurity.com.tw/article_detail.zspx?aid=9624
[4] [online]Stephen, W. (2020,5 21). Patch Management: A brief introduction. Retrieved from bmc blogs. [access on 2022.7.25]: https://www.bmc.com/blogs/patch-management/
[5] Souppaya, M., & Scarfone, K. (2022). Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (No. NIST Special Publication (SP) 800-40 Rev. 4). National Institute of Standards and Technology.
[6] Barker, E., Smid, M., & Branstad, D. (2014). A profile for us federal cryptographic key management systems. NIST Special Publication, 800, 152.
[7] 黃詠琦，2016，「因應金融科技發展－推動資訊架構標準化」，證券暨期貨月刊 第三十四卷 第十期，11-15頁
[8] [online] Wikipedia. (2020, June 18). Standard Operating Environment. WIKIPEDIA. [access on 2022.7.25]: https://en.wikipedia.org/wiki/Standard_Operating_Environment
[9] [online] Casey, K. (2020, November 24). 4 Benefits of a Standard Operating Environment (SOE). The Enterprises Project. [access on 2022.7.25]: https://enterprisersproject.com/article/2020/11/4-benefits-standard-operating-environment-soe
[10] Aupek, A. (2006). Architectural design of enterprise-wide standard operating environments.
[11] [online] Red hat. (2019). What Is an SOE ? Redhat.Com. [access on 2022.7.25]: https://www.redhat.com/en/topics/management/what-is-an-soe
[12] [online] Dodge, J. (Ed.). (2007). Virtual Center 2: Template Usage and Best Practices. Foedus. [access on 2022.7.25]: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vc-2-templates-usage-best-practices-white-paper.pdf
[13] Singh, J. (2021). An Approach to Personalize VMware vSphere Hypervisor (ESXi) Using HPE Image Streamer. In Progress in Advanced Computing and Intelligent Engineering (pp. 363-369). Springer, Singapore.
[14] Singh, J. (2021). An Approach to Personalize VMware vSphere Hypervisor (ESXi) Using HPE Image Streamer. In Progress in Advanced Computing and Intelligent Engineering (pp. 363-369). Springer, Singapore.
[15] GUIDE, V. D. VMware® AlwaysOn Desktop™.
[16] Kusek, C., & Daniel, A. (2011). VMware vSphere 5 Administration Instant Reference. John Wiley & Sons.
[17] [online] Posey, B. (2022). What Is Patch Management? Lifecycle, Benefits and Best Practices. Techtarget. [access on 2022.7.25]: https://www.techtarget.com/searchenterprisedesktop/definition/patch-management
[18] Cavusoglu, H., Cavusoglu, H., & Zhang, J. (2006, June). Economics of Security Patch Management. In WEIS.
[19] Gerace, T., & Cavusoglu, H. (2009). The critical elements of the patch management process. Communications of the ACM, 52(8), 117-121.
[20] Cavusoglu, H., Cavusoglu, H., & Zhang, J. (2006, June). Economics of Security Patch Management. In WEIS.
[21] Brykczynski, B., & Small, R. A. (2003). Reducing internet-based intrusions: Effective security patch management. IEEE software, 20(1), 50-57.
[22] Tom, S., Christiansen, D., & Berrett, D. (2008). Recommended practice for patch management of control systems (No. INL/EXT-08-14740). Idaho National Lab.(INL), Idaho Falls, ID (United States).
[23] [online] CVE. (2022). About the CVE Program. [access on 2022.7.25]: https://www.cve.org/About/Overview
[24] Red hat. (2022). Red Hat Enterprise Linux 8 Security Hardening Guide. Red Hat.
[25] Center for internet security, inc. (2022). CIS Red Hat Enterprise Linux 8 Benchmark.
[26] [online] 2020 cyber hygiene report: What you need to know now - lessons learned from a survey of the state of endpoint patching and hardening, [access on 2022.7.25] : https://patch.automox.com/rs/923-VQX-349/images/Automox_2020_Cyber_Hygiene_Report-What_You_Need_to_Know_Now.pdf
[27] Smalley, S., & Fraser, T. (2001). A security policy configuration for the Security-Enhanced Linux. NAI Labs Technical Report.
[28] [online] Chinthaguntla, K. (2020, April 22). Linux Package Management with YUM and RPM. Redhat.Com. [access on 2022.7.25]: https://www.redhat.com/sysadmin/how-manage-packages
[29] [online] Chan, A. (Ed.). (2015). Red Hat Satellite 6.0 User Guide. Access.Redhat.Com. [access on 2022.7.25]:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.0/html-single/user_guide/index
[30] Yin, R. K. (2009). Case study research: Design and methods (Vol. 5). Sage
[31] [online]TDCC. (2021). 集保結算所簡介. TDCC官網. [access on 2022.7.25]: https://www.tdcc.com.tw/portal/zh/about/about