摘要
雲端運算（Cloud Computing）透過網際網路的連結，透過大型資訊平台佈署及提供資訊服務，但雲端上商業資料可能成為網路攻擊的目標，故如何消除企業對雲端運算服務（cloud services）之資安的疑慮，使企業對網際網路資料中心（Internet Data Center, IDC）的資訊安全管理產生信心，是導入雲端運算的重要事務。若企業忽視雲端運算服務的資訊風險，將可能造成隱私資訊外洩並嚴重影響商譽。因此，企業須要有一套營運風險分析方法，系統化評選IDC 所提出的解決方案；現有風險分析方法較適用於資訊資產個別威脅事件為基礎之風險分析，面對雲端運算作業採用分散式服務架構，須分析多重網路攻擊事件間之交互影響，故本風險模式改以資訊資產之作業流程為基礎，運用模糊派翠網（Fuzzy Petri Net, FPN）理論完整分析作業的威脅流程，估算資產之各項作業的風險，將原有風險分析導入動態運作環境，搭配ISO／IEC 27001之資訊安全管控，系統化分析資訊資產的風險。最後舉一雲端運算服務平台風險分析為例，說明所研提的方法，探討案例中分散式佈署及資訊更新時所帶來的風險。
並列摘要
Cloud computing adopts the Internet to deliver information services to open networks via deployment of large scale of platforms, in which commercial data on the clouds might become targets of network attacks. How to eliminate the worries about information security on cloud services, raise the confidences on information security management of IDC is a crucial issue in cloud computing. It might lead to disclosure of confidential information and serious damage to business reputation, if enterprises neglected assessing the risks of cloud services. Thus, enterprises need systemically assess the operational risks with the proposals of IDC by comparing distinct cloud provider solutions, when decided to adopt the cloud services. Available risk models are more suitable for assessing the risk of information assets based on a series of specific threat events. It is necessary to adjust the risk model to effectively assess the risks of cloud services via analyzing the effects of multiple interleaved attacks from the view of asset operation flow perspective. Therefore, a fuzzy risk assessment model is proposed to evaluate the risks of cloud security in a dynamic environment using Fuzzy Petri Net (FPN) by adopting ISO/IEC 27001 standard. Finally, an illustration case of risk assessment of cloud services in Internet Data Center (IDC) is given to demonstrate our approach. From numerical illustrations, our approach effectively outranks the risks of cloud services, especially when they are deployed and updated their information in a distributed deployment.