Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 17
The vulnerability management of e-payment operating environment shall meet the following requirements:1. Detect changes to webpage and application, record the changes and inform relevant personnel to handle the situation.2. Detect the linkage of malicious networks and periodically update the list of malicious networks.3. Establish intrusion detection or intrusion prevention mechanism and periodically update malware behavioral features.4. Establish virus detection mechanism and periodically update virus definitions.5. Establish online control measures and restrict connection to non-business related websites to prevent the download of malware.6. Grasp readily information security incidents by promptly undertaking investigation of high-risk or important items and taking response actions.7. Conduct regularly social engineering email drill and training for system operations/maintenance personnel at least once a year.8. Carry out vulnerability scan every quarter and undertake risk evaluation based on the scan or testing results, draw up proper measures and set completion time for different risks, write up a report on evaluation results and actions taken, adopt proper measures and ensure that all operating systems and software applications are installed with tested security patches that are free of vulnerability concern.9. Avoid using system software and application software that have stopped vulnerability patches or update, and if necessary, take necessary safeguard measures.10. Carry out program code scan or black box testing before the e-payment platform goes online and for changed programs every half a year, and undertake risk evaluation based on the scan or test results, draw up proper measures and set completion time for different risks, conduct corrective actions, record handling situation and follow up on improvements.11. The e-payment platform should have penetration testing conducted every year to enhance information security.
中文原文 電子支付機構資訊系統標準及安全控管作業基準辦法第17條
電子支付作業環境之脆弱性管理應符合下列要求：
一、應偵測網頁與程式異動，紀錄並通知相關人員處理。
二、應偵測惡意網站連結並定期更新惡意網站清單。
三、應建立入侵偵測或入侵防禦機制並定期更新惡意程式行為特徵。
四、應建立病毒偵測機制並定期更新病毒碼。
五、應建立上網管制措施，限制連結非業務相關網站，以避免下載惡意程式。
六、應隨時掌握資安事件，針對高風險或重要項目立即進行清查與應變。
七、應針對系統維運人員定期執行電子郵件社交工程演練與教育訓練，至少每年一次。
八、每季應進行弱點掃描，並針對其掃描或測試結果進行風險評估，針對不同風險訂定適當措施及完成時間，填寫評估結果與處理情形，採取適當措施並確保作業系統及軟體安裝經測試且無弱點顧慮之安全修補程式。
九、應避免採用已停止弱點修補或更新之系統軟體與應用軟體，如有必要應採用必要防護措施。
十、電子支付平臺上線前及每半年應針對異動程式進行程式碼掃描或黑箱測試，並針對其掃描或測試結果進行風險評估，針對不同風險訂定適當措施及完成時間，執行矯正、紀錄處理情形並追蹤改善。
十一、電子支付平臺每年應執行滲透測試，以加強資訊安全。
一、應偵測網頁與程式異動，紀錄並通知相關人員處理。
二、應偵測惡意網站連結並定期更新惡意網站清單。
三、應建立入侵偵測或入侵防禦機制並定期更新惡意程式行為特徵。
四、應建立病毒偵測機制並定期更新病毒碼。
五、應建立上網管制措施，限制連結非業務相關網站，以避免下載惡意程式。
六、應隨時掌握資安事件，針對高風險或重要項目立即進行清查與應變。
七、應針對系統維運人員定期執行電子郵件社交工程演練與教育訓練，至少每年一次。
八、每季應進行弱點掃描，並針對其掃描或測試結果進行風險評估，針對不同風險訂定適當措施及完成時間，填寫評估結果與處理情形，採取適當措施並確保作業系統及軟體安裝經測試且無弱點顧慮之安全修補程式。
九、應避免採用已停止弱點修補或更新之系統軟體與應用軟體，如有必要應採用必要防護措施。
十、電子支付平臺上線前及每半年應針對異動程式進行程式碼掃描或黑箱測試，並針對其掃描或測試結果進行風險評估，針對不同風險訂定適當措施及完成時間，執行矯正、紀錄處理情形並追蹤改善。
十一、電子支付平臺每年應執行滲透測試，以加強資訊安全。