INFORMATION TECHNOLOGY SECURITY MANAGEMENT: A CASE STUDY OF PERSONAL DATA PROTECTION IN ELECTRONIC TRANSACTION OF THAI COMMERCIAL BANKS

Abstract

          The Objectives of this research article were to 1) study and analyze the context, condition, problems, and roles as well as the measure of the government sector in information security management, 2) study the actions and measures of Thai commercial bank in information security management and personal data protection, and 3) study recommendations and guidelines for the implementation and appropriate measures for information security management to protect personal information in electronic transactions of Thai commercial bank. The research is a qualitative research consisting of research on the documentation and in - depth interviews of 10 executives, government regulators, specialists and 3 case studies of Thai commercial bank, selected by purposive selection. The data content was analyzed and the results were presented in a descriptive format. The study found that 1) the major cyber threats are cybersecurity readiness and preparedness to cope with the loss of national cyber sovereignty. The government has issued two important laws in 2019, namely, the Cyber Act and the Personal Data Protection Act, and the Bank of Thailand has issued various regulations to supervise Thai commercial bank, 2) Thai commercial banks have established policies and operational guidelines for information security and cybersecurity in accordance with the Information Security Management Standard (ISO/IEC 27001: 2013), and 3) Based on the study of recommendations to provide guidelines for the implementation of Cyber Security Act, the NIST Cybersecurity Framework and ISO/IEC 27701: 2019 should be applied as an additional measure for the protection of personal information that is in accordance with Personal Data Protection Act.