雲端運算資訊安全之研究

Three Essays on Information Security for Cloud Computing

郭錦華(Jen-Hwa Kuo)

指導教授 ： 王正華

共同指導教授 ： 林秋娟

長榮大學/管理學院/經營管理研究所/博士(2014年)

https://doi.org/10.6833/CJCU.2014.00001

摘要

雲端運算的快速發展，使得雲端運算的資訊安全議題近幾年來受到學術界和實務界之關注，然而，企業在導入雲端運算系統時，忽略使用者對資訊安全的行為認知，往往產生系統導入的抗拒與排斥。因此，企業在設定雲端運算服務的目標如何符合使用者的行為企圖是值得關切的。具體來說，本研究包括以下三個研究：
第一個研究基於探討雲端運算資訊安全的研究發展，本研究分析過去十年SCI及SSCI學術資料庫的數據，確定與資訊系統安全有關的最重要期刊、論文及學者，並透過因素分析及知識社群網絡分析，發現前後五年有關資訊安全相關研究的發展變化與未來趨勢。
第二個研究基於探討雲端運算資訊安全的研究發展，本研究分析近年主要期刊在雲端運算資訊安全領域發表的論文164篇。本文使用分類識別法將研究議題分為雲端運算的理論與研究、軟體即服務(SaaS)、平台即服務(PaaS)、基礎設施及服務(IaaS)及雲端運算密碼驗證與加密等五類，探討雲端運算資訊安全的主要議題與未來主要研究方向。
第三個研究究基於探討雲端運算資訊安全的行為意圖，本研究對國內九家民間企業進行問卷調查，了解企業內部使用者面對雲端運算安全的行為認知。本研究採用主觀規範、感知嚴重、隱私關注、自我效能感、行為意圖及採用行為等六個變數進行分析，以瞭解雲端運算使用者對資訊安全在行為認知上的主要影響因素。
本研究對於學術上之貢獻在於發展一個適用於雲端運算資訊安全行為認知的理論模式，解釋面對雲端運算時使用者對資訊安全的認知行為；對於實務界而言，本研究亦提供組織在導入雲端運算相關資訊系統時針對資訊安全管理之具體建議。

關鍵字

雲端運算 ； 資訊安全 ； 隱私的關心 ； 自我效能 ； 主觀意識

並列摘要

In response to the demand for cloud computing security, this thesis investigates the factors that influence employees’ use of information security enabled or facilitated by cloud computing through three independent but related studies.
The first study examines the status of contemporary information systems security research in the last ten years with citation and co-citation analysis. Using the data collected in the SCI and SSCI, this study identified the most important publications as well as the most influential scholars and journals in information systems security, and mapped the major research paradigms on the subject. The results of the study help illustrate the invisible network of knowledge production in information systems security and provide valuable understanding for the change of research paradigm of information systems security studies.
The second study suggests that although a large volume of literature on cloud computing is available. The subject is still under development and offers great potentials for further research and applications. It is believed that a review of the state-of-art research and applications in cloud computing security would encourage further research on cloud computing technologies. This paper thus reviews the prior literature on the subject using a classification scheme to identify the theory and practice and future research directions. 164 articles are analyzed and classified based on the scheme that consists of five distinct categories: cloud computing theory and research, SaaS, PaaS, IaaS, and cloud computing authentication and encryption. In addition, a comprehensive list of references is presented. It is hoped that the findings of this research would provide useful insights into the anatomy of cloud computing literature and be a good source for anyone who is interested in cloud computing.
The third study distinguishes between internal and external information resource and examines the backgrounds and outcomes of their use from a job-related perspective on security. Based on survey data collected from nine companies in Taiwan, it is found that employees tend to use internal information system resources when their tasks depend on security behavioral intentions. On the other hand, they are more likely to use external cloud computing resources when faced with complex and non-routine tasks. Furthermore, internal information resources help employees’ performance in replication and adaptation, while external cloud computing resources helps the performance in adaptation and innovation.
The papers reviewed in this dissertation vary in subjects and research methods, while they have one feature in common -- the focus on the use of cloud computing and information security qualitative and quantitative methods for analysis. The three studies in this dissertation look into the questions regarding the information security available on the cloud computing, and issues of privacy concern, trust, self-efficacy, subjective norm and perceived threat. It finds that trust is the main concern on the information systems security, and the management of historical record would facilitate future research and applications.

並列關鍵字

cloud computing ； security information system ； privacy concern ； self-efficacy ； subjective norm

參考文獻

Feng, Z. Q., Bai, B., Zhao, B. K., & Su, J. S. (2012). Redball: Throttling shrew attack in cloud data center networks. Journal of Internet Technology, 13(4), 667-679.

Hu, L. K., Ying, S., Jia, X. Y., Zhao, K. (2010). A semantics based approach for cross domain access control. Journal of Internet Technology, 8(6), 44-50.

Huang, S. M., Chang, S. I., & Su, K. H. (2006). Critical success factors for implementing BS7799 information security management system - based on petrochemical industry. Journal of Information Management, 13(2), 171-192.

Li, Z., Yu, NH., & Li, Y. (2010). Asynchronous parallel finite automaton: A new mechanism for deep packet inspection in cloud computing. Journal of Internet Technology, 11(2), 269-277.

Nyre, A. A., & Jaatun, M. G. (2010). A probabilistic approach to information control. Journal of Internet Technology, 11(3), 407-416.