雲端風險管理與保險規劃之研究

Risk Management and Insurance Strategy for Utilizing Cloud Computing Services

郭仁杰(Ren-Jie Guo)

指導教授 ： 高棟梁

共同指導教授 ： 范姜肱(Chiang-Ku Fan)

淡江大學/商管學院/保險學系保險經營碩士班/碩士(2013年)

https://doi.org/10.6846/TKU.2013.00964

摘要

近年來，在科技及電子設備的快速進步下，傳統電腦設備已無法滿足人們快速成長的服務需求，因而促成雲端服務的崛起。雲端服務具有許多足以取代傳統設備的優點，尤其是以網路即可迅速取得高效率的服務，且以pay-as-you-go的計費方式也有助於企業節省支出，使其在全球廣為發展且漸受人們重視。

然而，雲端服務仍隱含著數種不同的潛在風險，例如：個人資料的隱私、儲存伺服器的中斷或機密資料遭駭客盜取等等。但目前各國並無專門為雲端服務所設計的保單，能夠完全承保所有的雲端風險，僅能以網路安全險(Network security coverage)或資訊業專業責任保險(Technology professional liability)去做部份承保。因此，本研究之目的為辨識及評估各種雲端服務的潛在風險，以提供企業決策者在風險管理時必要的資訊，並做出最適之風險管理計劃之建議。

本研究之第一階段會使用德菲法(Delphi Method)，透過專家訪談去辨別出雲端服務之潛在風險，並依此做為風險評估之架構；第二階段則是以網路層級分析法(Analysis Network Process method)去辨別出雲端風險在損失頻率與損失幅度上的相對權重；第三階段會依前述得到之損失頻率與幅度，將各雲端風險列在風險管理矩陣中，以方便找出個別雲端風險最合適之應對方法；最後階段則是以歐美地區的專家訪談及保單資料彙整，找出目前此類保單對各雲端風險的承保狀況，並理解現行保單所能提供的保障與企業實際需求之間是否有保障缺口(Gap)，及是否能透過保單來處理該雲端風險。

透過上述方法，我們將11種雲端風險分類到風險矩陣之四個象限後，就能依各象限的損失幅度與頻率找出相應的風險管理方法；另外，透過歐美專家訪談與保單整理之結果，亦能將各風險的實際承保狀況分為高度承保(Highly Insurable)與極少承保(Rarely Insurable)兩種，最終會綜合風險矩陣和承保狀況來彙總判斷各雲端風險最適合之風險管理方法。

關鍵字

雲端運算 ； 風險管理 ； 德菲法 ； 網路層級分析法

並列摘要

Cloud computing is not only a brand-new conception of information technology, but also a service that can improve people’s life obviously. Enterprises can acquire the cloud services they need directly by internet. The system using pay-as-you-go as payment method also has advantage on both cost-efficiency and flexibility for cloud service users. Therefore, it seems an unavoidable trend that traditional computer facilities will be replaced by cloud computing recently. Cloud services may help the enterprise in many ways, but it also inevitably triggers some loss exposure.

Unfortunately, there is little objective scientific research focused on identifying and evaluating the loss exposures that result from cloud computing. The major research objective is to identify the loss exposures of cloud computing services using scientific and objective methods, and measure loss exposures with regard to the application of cloud computing. Furthermore, using our finding to suggest essential risk management strategies that can be employed to control or reduce losses attributable to the application of cloud computing.
In order to reach research’s purposes, the major employed methods are Delphi study, Analysis Network Process method (ANP), and expert interview. This study, first of all, conduct Delphi study and ANP method to identify the potential cloud risks and to find the relative weigh of each risk. Second, by locating the identified loss exposures in the risk management matrix, this research develop appropriate treatments to the risks of cloud computing. Finally, by interview the underwriters of insurance companies in U.S.A and Europe and comparing the identified risks of cloud computing, this study can find the gap between coverage providing and coverage needs. Combining those results, the findings of this study can help the enterprises or cloud users to manage those risks, and offer the insurers sufficient information to design a cloud policy.

並列關鍵字

Cloud computing ； Risk management ； Delphi study ； Analysis Network Process method

參考文獻

3. Aven, T. and Renn, O. (2009), The Role of Quantitative Risk Assessments for Characterizing Risk and Uncertainty and Delineating Appropriate Risk Management Options, with Special Emphasis on Terrorism Risk, Risk Analysis: An International Journal, 29(4), p.p.587-600.

7. Cox, L. A. (2008), What’s wrong with risk Matrices? Risk Analysis, 28(2), p.p.497-515.

9. Hand, J. D. (2007), Principles of Data Mining, Adis Data Information BV.

13. Fowles, J. (1978), Handbook of futures research. Greenwood Press: Connecticut.

14. Lackermair, G. (2011), Hybrid cloud architectures for the online commerce Original Research Article, Procedia Computer Science, 3, p.p.550-5.