元大金控元大金控 元大金控元大金控 元大金控元大金控

繁 简 EN
資訊安全 信息安全 Information Security
資訊安全 信息安全 Information Security
資訊安全 信息安全 Information Security 個資保護 个资保护 Personal Data Protection
資訊安全 信息安全 Information Security
Cyber Security Risk Management Framework and Mechanism

The board of directors is the highest decision-making body for information security management of Yuanta Financial Holding Company (FHC). Yuanta FHC has set forth an “Information Security Policy” approved by the board of directors as a basis to establish an information security management system for Yuanta FHC and subsidiaries and to formulate relevant information security management regulations and procedures. In addition, Yuanta FHC’s Information Security Policy is based on the protection of shareholders’ rights and interests, with the objectives of “protecting the security of information assets” and “maintaining business continuity to achieve sustainable corporate operation.”

In order to enhance Yuanta FHC’s decision-making ability on information security issues, Yuanta FHC and major subsidiaries have established a chief information security officer to plan as a whole the promotion and coordination of information security policies and the deployment of resources. Yuanta FHC has also set up a dedicated or responsible unit for information security, responsible for information security planning, monitoring, and execution of information security management operations, which reports annually to the board of directors on the overall implementation of information security in the previous year in order to strengthen the supervision of information security. Yuanta FHC’s information security dedicated unit is staffed with fourteen (14) information security professionals, and the report on information security implementation status was reported on January 20, 2025 at the 35th meeting of the ninth (9th) board of directors.

With the purpose of coordinating the management of information security matters, Yuanta FHC has formed an inter-departmental “Information Security Group,” with the chief executive officer appointing the convener and vice convener, which holds regular information security meetings and management review meetings. Six (6) meetings were held in 2024 to discuss the implementation of information security management and information security-related matters to enhance the overall information security protection capabilities.

Specific Management Plans and Input Resources

Specific management programs and resources to be invested in the establishment of comprehensive information security protection to achieve the information security policy and objectives are set out below:

Introduction of international information security management standards and obtainment of certification

In order to continuously improve the information security governance system, in addition to complying with domestic and international information security laws and regulations, Yuanta FHC, Yuanta Securities, Yuanta Bank, Yuanta Life, Yuanta Funds, and Yuanta Futures have all adopted the ISO 27001:2022 Information Security Management System (ISMS) standard, which is renewed annually and re-audited every three years. We all have already been certified in 2024, and the certificates are valid and continue to strengthen the monitoring and management of information security with the PDCA (Plan-Do-Check-Act) quality management framework. The validity period of Yuanta FHC’s certificate is from December 2023 to December 2026.

In line with the Financial Cyber Security Action Plan of Taiwan’s Financial Supervisory Commission (FSC) and to increase the capacity of business continuity management, Yuanta Bank, Yuanta Life, Yuanta Securities, and Yuanta Funds have adopted the international standard for business continuity management (ISO 22301), and will continue to undergo the annual renewal of the certification. All have been certified in 2024, and the certificates will continue to be valid. Based on a risk-oriented approach, we combine business-side and system-side resources to ensure that operational standards can be maintained under any circumstances, to reduce the risk of business interruption, and to make the organization more resilient.

Information security protection mechanism and detection

We have upgraded our network and information system protection capabilities and established a multi-layered defense-in-depth framework, including network firewalls, software application firewalls, intrusion detection systems, spam filtering, email APT, Internet behavior management, anti-virus systems, anti-phishing websites and counterfeit APP monitoring mechanisms, endpoint detection and threat response mechanisms (EDR), and network detection and response (NDR) to ensure the security of our information systems.

Yuanta FHC and major subsidiaries regularly perform vulnerability scanning, penetration testing, distributed denial-of-service (DDoS) drills, social engineering drills, and computer system information security evaluations on a regular basis through independent third parties in order to safeguard the stability and security of the information system and the completeness and effectiveness of the existing controls.

Information security protection detection and monitoring

With the rapid development of financial technology, information security has become an important risk management issue for organizations. In order to keep abreast of emerging information and security trends, Yuanta FHC and major subsidiaries have joined the Financial Information Security Information Sharing and Analysis Center (F-ISAC) and participated in the Financial Security Operation Center (F-SOC) for cross-domain joint defense and sharing of information security events to effectively enhance the overall information security defense capability. We have also introduced Security Information and Event Management (SIEM) to ensure the effectiveness of information security protection and monitoring.

In order to improve the timeliness and effectiveness of network abnormal behavior detection and alerts, and in line with the FSC’s Financial Cyber Security Action Plan, Yuanta FHC and subsidiaries have commissioned a third-party professional organization to build a security operations center (SOC) monitoring mechanism. Through 7x24 real-time monitoring, we provide pre-emptive threat alerts, real-time threat warnings, and post-threat analysis and recommendations to boost our ability to respond to information security incidents and to achieve the effectiveness of joint defense and coordinated operation of information security monitoring. We have also built information security management monitoring dashboards to instantly keep track of changes in information security risk indicators such as computer viruses, hacking, and data leakage, in order to achieve Yuanta Group’s goal of information security monitoring joint defense.

Information security attack and defense exercises and major information security incident exercises

In order to evaluate our defense-in-depth capability and to comply with the FSC’s Financial Cyber Security Action Plan, Yuanta has organized the Group’s red and blue team attack and defense exercises. We have commissioned a professional third party to conduct a target-oriented information security exercise using hacking techniques without affecting our operations to verify the effectiveness of information security protection, monitoring, and defense, to enhance our employees’ ability to deal with new types of attacks, and to carry out remedial or compensatory measures for the weaknesses identified in the exercise. We also implemented remedial or compensatory measures for weaknesses identified during the exercise. In addition, the feasibility of the recommendations made by the professional third party has been assessed and corresponding measures have been planned, with a view to further strengthening Yuanta FHC’s information security defense and reducing the impact of information security incidents.

In order to evaluate our defense-in-depth capability and to comply with the FSC’s Financial Cyber Security Action Plan, Yuanta has organized the Group’s red and blue team attack and defense exercises. We have commissioned a professional third party to conduct a target-oriented information security exercise using hacking techniques without affecting our operations to verify the effectiveness of information security protection, monitoring, and defense, to enhance our employees’ ability to deal with new types of attacks, and to carry out remedial or compensatory measures for the weaknesses identified in the exercise. We also implemented remedial or compensatory measures for weaknesses identified during the exercise. In addition, the feasibility of the recommendations made by the professional third party has been assessed and corresponding measures have been planned, with a view to further strengthening Yuanta FHC’s information security defense and reducing the impact of information security incidents.

Information security education and training

Yuanta FHC and major subsidiaries have completed three (3) hours of information security education and training for general employees and fifteen (15) hours of information security professional training courses for information security specialists in 2024 to strengthen information security capabilities. Furthermore, we also hold email social engineering exercises regularly to raise the information security awareness of all employees.

Management of Major Cyber Security Incidents

Yuanta FHC and major subsidiaries have established procedures for notifying and handling information security incidents, notifying and handling at the appropriate level according to the level of the incident.

The information unit is required to troubleshoot and resolve the incident within the target processing time and analyze the incident after it has been processed to prevent recurrence.

In the most recent year and up to the printing date of the Annual Report, there were no significant information security incidents that caused damage to customers’ rights and interests or affected the sound operation of the organization.