影響雲端運算服務使用意願之資安與風險因素探討

近年來雲端運算的興起引起各大業界的關注，紛紛成為業界討論的焦點，然儘管雲端運算替產業界創造機會，它同時也面臨了許多挑戰，由資策會針對台灣大型企業對雲端服務的採用疑慮調查中顯示，「資訊安全問題揮之不去」占了38.5%，名列8大疑慮之首，顯示企業對於資訊安全的保障仍缺乏信心，成為影響使用者使用雲端運算服務意願的首要因素。　　為此本研究的研究目的便是要找出「哪些資安及風險因素會影響使用者採用或建置雲端運算服務的使用意願」以及「因素是如何對使用者產生影響」。在影響因素部分，本研究採用雲端安全聯盟所提出之七大資安威脅（不安全的介面與應用程式介面、惡意的內部員工、共享環境所造成的議題、資料遺失或外洩、帳號或服務被竊取、稽核與蒐證、其他未知的風險）以及Benaroch et al.（2006）在其研究中匯整之IT投資面臨的八大風險因素（成本、效益、專案、功能、組織、競爭對手、環境、技術），統整共十五項資安威脅及風險假設因素。　　本研究採用個案研究的研究方法，以國內七間企業和一間學校為個案研究對象，衡量其對於雲端運算的資安考量，並驗證這些資安威脅和風險因素會影響雲端服務的採用意願。研究結果顯示，惡意的內部員工、共享環境所造成的議題、資料遺失或外洩、帳號或服務被竊取、其他未知的風險、功能風險等六項因素會嚴重影響雲端運算服務的採用意願；專案風險、環境風險、技術風險等三項因素對於雲端運算服務的採用意願負面影響程度是中等；稽核與蒐證、不安全的介面與應用程式介面、成本風險、效益風險、組織風險、競爭對手風險對於雲端運算服務採用意願的負面影響程度是低的。最後，本研究亦透過整合的觀點替雲端運算的環境建立一套風險管控的依循步驟，依照採用服務的使用流程，分別針對合約前、合約中、與合約後提出資安威脅與風險的評估步驟與建議，提供企業做為採用此項新科技的風險評估參考。

關鍵字

雲端運算；雲端運算服務；資訊安全；風險控管

並列摘要

Recently, the rising of cloud computing has drawn each industry’s attention. While cloud computing creates some opportunities for industries, it also encounters many challenges. According to the result of Institute for Information Industry’s research about large company’s concern when considering using cloud-based services in Taiwan, “the existence of information systems security problem” accounts for 38.5%, being the top 1 of all of the concerns. It shows that many corporations have little confidence in security protection provided by cloud service provider, thus information systems security problem becomes the primary factor affecting user’s will to adopt cloud-based services This study’s objective is to find out which security and risk factors will affect user’s will to use or establish cloud-based services and how these factors affect users in their unique contexts. For the influence factors, this study adopts “Top 7 Threats to Cloud Computing” introduced by Cloud Security Alliance: insecure interfaces and APIs, malicious insiders, shared technology issues, data loss or leakage, account or service hijacking, auditing and evidence gathering, unknown risk profile, and 8 risk fields for information technology investment collected by Benaroch et al.（2006）: costs, benefits, project, function, organizational, competition, environmental, technological. There are overall 15 security and risk factors proposed. This study use multiple case studies as methodology, choose 7 companies and 1 school as our case study subjects, and judge their security concerns as for cloud computing. We also justify our selection of factors influencing the willingness to adopt cloud-based services. The results of analyses show that malicious insiders, shared technology issues, data loss or leakage, account or service hijacking, unknown risk profile, and function risk factors will severely and negatively affect users’ willingness, which means their affecting level is high. The negative affecting level of project risk, environmental risk, and technological risk is medium. The negative affecting level of auditing and evidence gathering, insecure interfaces and APIs, costs, benefits, environmental risk, and competition risk is relatively low. Last, with an integration view, this study constructs some recommended steps in risk management for cloud computing environment. Based on the service adopting process, we propose a three-stage (before a contract, period of signing a contract, after a contract) security and risk assessing steps and come up with some suggestions. We hope the risk assessments provided by this study can be a useful reference for those companies that are willing to use this new IT.

並列關鍵字

cloud computing ； cloud-based services ； information systems security ； risk management

參考文獻

[3] 萬文隆（2004），”深度訪談在質性研究中的應用”，生活科技教育月刊，第三十七卷第四期

[5] 林金定、嚴嘉楓、陳美花（2005），”質性研究方法：訪談模式與時施步驟分析”，身心障礙研究，第三卷第二期

[7] 王子夏、王平、林文暉、郭溥村、盧永翔（2010），”雲端運算服務之資安風險與挑戰”，資訊安全通訊期刊，第十六卷第二期

[12] DavisD.Fred.(1989), “Perceived Usefulness, Perceived Ease of Use, and User Acceptance of Information Technology, ” MIS Quarterly, pp.319-340.

[14] So, M.W.C. and Sculli, D. (2002), “The role of trust, quality, value and risk in conducting e-business”, Industrial Management & Data Systems, Vol. 102 No. 9, pp. 503-12.

國際替代計量

影響雲端運算服務使用意願之資安與風險因素探討

全文下載

主題瀏覽