【Taiwan】iPAS Junior Cybersecurity Engineer（ iPAS初級資安工程師）

To ensure sufficient talent for industrial upgrading and transformation, Taiwan's Ministry of Economic Affairs launched a special project in 2016 to promote the assessment of industrial talent capabilities. This project integrates the resources of industry, government, academia, and research institutions to establish a capability assessment system and expand the range of examinations. The Ministry of Economic Affairs issues capability assessment certificates and encourages companies to prioritize interviewing/hiring and offer higher salaries to certified individuals. 

Therefore, in response to the development trends and talent needs in the domestic information security field, we are planning an industry talent competency assessment system. This system aims to effectively guide schools and training institutions to plan courses according to industry needs, thereby helping students narrow the gap between learning and application in their employment. At the same time, it encourages students and professionals in related fields to take the exam, guides private institutions to invest in the training industry, and cultivates talents that meet the needs of industry and enterprise upgrading and transformation through a training-examination-application cycle. It also provides objective reference for enterprises to select outstanding key talents, thereby improving the quality and competitiveness of information security industry talents.

This certification is an entry-level certification and is not listed in the list of cybersecurity certifications recognized by Taiwan's Ministry of Digital Development. However, it still attracts many Taiwanese candidates to take the exam. This is because the prevalence of ransomware has led to a surge in corporate demand for cybersecurity expertise, with companies willing to offer relatively high salaries. Furthermore, as companies expand into international markets, they face compliance requirements under laws such as the CRA, GDPR, and various countries' personal data protection laws, necessitating cybersecurity professionals to penetrate these markets.

The Junior Cybersecurity Engineer exam consists of two subjects: Introduction to Information Security Management and Introduction to Information Security Technology. Each subject has 50 multiple-choice questions, each worth 2 points, with no penalty for incorrect answers. The passing score for each subject is 70 points. However, if the average score is 70 points but the passing score is not lower than 60 points, the certification standard is still met.

For corporate HR professionals, obtaining this certification signifies the ability and basic knowledge of cybersecurity. Students can work as cybersecurity interns, while experienced individuals can serve as managers managing ISO 27001 cybersecurity compliance documents or as technical cybersecurity assistants. Salary is approximately NTD 40,000-450,000.

 

Subject	Evaluation Theme	Evaluation content	Knowledge Points
Subject 1: Introduction to Information Security Management	1. Information Security Management Concept	1-1. Information Security Management System	• Definitions, basic concepts, and contextual applications of data confidentiality, integrity, and availability. • Basic concepts of information security management systems, such as implementation steps, ISO standard verification, audit activities, system monitoring, and entity control measures. • Important domestic and international cybersecurity regulations, compliance and privacy-related frameworks, and operational guidelines. • Important cybersecurity incidents and concepts relevant to current events.
		1-2. Overview and Compliance of Relevant Laws and Regulations
		1-3. Privacy Protection and Intellectual Property Rights
	2. Asset and Risk Management	2-1. Asset Classification, Grading, and Inventory	• Basic concepts of information asset classification, grading, and inventory • Basic concepts of information asset management principles and procedures • Basic concepts of risk definition, risk assessment and treatment, and risk evaluation
		2-2. Risk Assessment and Risk Management
	3. Access control, encryption/decryption, and key management	3-1. Access Control and Authentication	• Basic concepts of access control methods and principles, such as network system access management and organizational internal access control policies. • Basic concepts of access control and authentication mechanisms, such as biometric identification, keys, credentials, and encryption/decryption mechanisms.
		3-2. Encryption/Decryption and Key Lifecycle
	4. Accident Management and Operational Continuity	4-1. Incident and Accident Management	• Basic concepts of incident handling, such as: notification and response operations, log comparison, chain of custody, etc. • Basic concepts of data backup and operational continuity management
		4-2. Standby and Operational Continuity

 

 

Subject	Evaluation Theme	Evaluation content	Knowledge Points
Subject Two: Introduction to Information Security Technology	1. Network and communication security	1-1. Network Security	• Basic concepts of common network attack techniques • Basic concepts of network devices and network communication protocols • Basic concepts of firewalls
		1-2. Communication Security
	2. Operating System and Application Security	2-1. Operating System Safety	• Basic concepts of common network attack methods, such as ransomware, denial-of-service attacks, SQL injection , phishing , CSRF , and XSS . • Basic concepts of network devices and network communication protocols. • Basic concepts of firewalls.
		2-2. Operating System and Application ( including databases and web pages ) Attack Methods
		2-3. Program and Development Security
	3. Cybersecurity Maintenance Technology	3-1. Malicious Program Protection and Vulnerability Management	• Basic concepts of commonly used vulnerability scanning tools, understanding and prevention of malware • Basic concepts of database security backup mechanisms, restoration, and destruction • Basic concepts of password storage and protection • Basic concepts of system log management and analysis
		3-2. Data Security and Backup Management
		3-3. Log Management
	4. Emerging technology security	4-1. Introduction to Cloud Security	• Basic concepts of cloud information system security management • Basic concepts of mobile device protection • Basic concepts of smart manufacturing and Internet of Things protection

台灣的經濟部為充裕產業升級轉型所需人才，於105年起專案推動產業人才能力鑑定業務，整合產官學研共同能量，建立能力鑑定體制及擴大辦理考試項目，由經濟部核發能力鑑定證書，並促進企業優先面試/聘用及加薪獲證者。 

爰此，因應國內資訊安全領域發展趨勢與人才需要，策劃產業人才之能力鑑定制度，期有效引導學校或培訓機構因應產業需求規劃課程，以輔導學生就業縮短學用落差，同時鼓勵我國在校學生及相關領域從業人員報考，引導民間機構投入培訓產業，以訓考用循環模式培養符合產業及企業升級轉型所需人才並提供企業選用優秀關鍵人才之客觀參考依據，以提升資訊安全產業人才之素質與競爭力。

這張證照是入門級證照，也未列入台灣的數位發展部認可的資安證照清單之列。但仍吸引很多台灣考生報名考試。原因是因為勒索病毒盛行，企業資安需求大增，願意用相對高薪徵才；以及企業在拓展國際市場時，有CRA、GDPR、各國個資法等法令的合規要求，需要懂資安的人才才能打進去。

初級資安工程師考試分為二科，資訊安全管理概論、資訊安全技術概論，每科考50題單選題，每題2分答錯不倒扣，及格分數各為70分，但如果平均達到70分而不及格科目未低於60分，仍達到授證標準。

對企業人資而言，取得這張證照，代表具有資安的學習能力和基礎知識，如為在學學生可以擔任資安實習生，如為經驗人仕，可以擔任管理面的企業資安合規ISO27001的文件經營管理員，或者技術面的資安助理人員。薪水大約NTD40000-450000。

科目	評鑑主題	評鑑內容	知識點
科目一： 資訊安全 管理概論	1. 資訊安全管理概念	1-1. 資訊安全管理系統	• 資料機密性、完整性與可用性之定義、基本觀念，以及情境應用之理解 • 資訊安全管理系統之基本觀念，如：導入步驟、 ISO 標準驗證、稽核活動、系統監控、實體控制措施等 • 國內外重要資安法規，合規及隱私相關框架作業規範 • 與時事相關之重要資安事件與概念
		1-2. 相關法規概論與遵循
		1-3. 隱私權保護與智慧財產權
	2. 資產與風險管理	2-1. 資產分類分級與盤點	• 資訊資產分類分級與盤點之基本觀念 • 資訊資產管理原則與程序之基本觀念 • 風險定義、風險評估與處理及風險評鑑之基本觀念
		2-2. 風險評鑑與風險處理
	3. 存取控制、加解密與金鑰管理	3-1. 存取控制與身份認證	• 存取控制的方法與原則之基本觀念，如：網路系統存取管理、組織內部存取控制政策等 • 權限管理與身分認證機制之基本觀念，如：生物特徵辨識、金鑰、憑證、加解密機制等
		3-2. 加解密與金鑰生命週期
	4. 事故管理與營運持續	4-1. 事件與事故管理	• 事故處理之基本觀念，如：通報應變作業、日誌比對、證據保管鏈等 • 資料備援與營運持續管理之基本觀念
		4-2. 備援與營運持續

 

 

科目	評鑑主題	評鑑內容	知識點
科目二： 資訊安全 技術概論	1. 網路與通訊安全	1-1. 網路安全	• 常見網路攻擊手法之基本觀念 • 網路設備與網路通訊協定之基本觀念 • 防火牆之基本觀念
		1-2. 通訊安全
	2. 作業系統與應用程式安全	2-1. 作業系統安全	• 常見網路攻擊手法之基本觀念，如：勒索病毒、阻斷服務、 SQL Injection 、 Phishing 、 CSRF 、 XSS 等 • 網路設備與網路通訊協定之基本觀念 • 防火牆之基本觀念
		2-2. 作業系統與應用程式 ( 含資料庫與網頁 ) 攻擊手法
		2-3. 程式與開發安全
	3. 資安維運技術	3-1. 惡意程式防護與弱點管理	• 常用漏洞掃描工具、惡意程式的認識及防範之基本觀念 • 資料庫安全備份機制、復原、銷毀之基本觀念 • 密碼儲存與保護之基本觀念 • 系統日誌管理與分析之基本觀念
		3-2. 資料安全及備份管理
		3-3. 日誌管理
	4. 新興科技安全	4-1. 雲端安全概論	• 雲端資訊系統安全管理之基本觀念 • 行動裝置防護之基本觀念 • 智慧製造及物聯網防護之基本觀念
		4-2. 行動裝置安全概論
		4-3. 智慧製造及物聯網安全概論