查詢結果分析
來源資料
頁籤選單縮合
| 題 名 | 雲端運算服務之風險分析=Risk Assessment of Cloud Services |
|---|---|
| 作 者 | 王平; 羅濟群; 趙國銘; 王子夏; | 書刊名 | 管理評論 |
| 卷 期 | 31:1 2012.01[民101.01] |
| 頁 次 | 頁1-19 |
| 分類號 | 312.76 |
| 關鍵詞 | 風險分析; 雲端運算; 雲端運算服務; 模糊派翠網; Risk assessment; Cloud computing; Cloud services; Fuzzy Petri Net; |
| 語 文 | 中文(Chinese) |
| 中文摘要 | 雲端運算(Cloud Computing)透過網際網路的連結,透過大型資訊平台佈署及提供資訊服務,但雲端上商業資料可能成為網路攻擊的目標,故如何消除企業對雲端運算服務(cloud services)之資安的疑慮,使企業對網際網路資料中心(Internet Data Center, IDC)的資訊安全管理產生信心,是導入雲端運算的重要事務。若企業忽視雲端運算服務的資訊風險,將可能造成隱私資訊外洩並嚴重影響商譽。因此,企業須要有一套營運風險分析方法,系統化評選IDC 所提出的解決方案;現有風險分析方法較適用於資訊資產個別威脅事件為基礎之風險分析,面對雲端運算作業採用分散式服務架構,須分析多重網路攻擊事件間之交互影響,故本風險模式改以資訊資產之作業流程為基礎,運用模糊派翠網(Fuzzy Petri Net, FPN)理論完整分析作業的威脅流程,估算資產之各項作業的風險,將原有風險分析導入動態運作環境,搭配ISO/IEC 27001之資訊安全管控,系統化分析資訊資產的風險。最後舉一雲端運算服務平台風險分析為例,說明所研提的方法,探討案例中分散式佈署及資訊更新時所帶來的風險。 |
| 英文摘要 | Cloud computing adopts the Internet to deliver information services to open networks via deployment of large scale of platforms, in which commercial data on the clouds might become targets of network attacks. How to eliminate the worries about information security on cloud services, raise the confidences on information security management of IDC is a crucial issue in cloud computing. It might lead to disclosure of confidential information and serious damage to business reputation, if enterprises neglected assessing the risks of cloud services. Thus, enterprises need systemically assess the operational risks with the proposals of IDC by comparing distinct cloud provider solutions, when decided to adopt the cloud services. Available risk models are more suitable for assessing the risk of information assets based on a series of specific threat events. It is necessary to adjust the risk model to effectively assess the risks of cloud services via analyzing the effects of multiple interleaved attacks from the view of asset operation flow perspective. Therefore, a fuzzy risk assessment model is proposed to evaluate the risks of cloud security in a dynamic environment using Fuzzy Petri Net (FPN) by adopting ISO/IEC 27001 standard. Finally, an illustration case of risk assessment of cloud services in Internet Data Center (IDC) is given to demonstrate our approach. From numerical illustrations, our approach effectively outranks the risks of cloud services, especially when they are deployed and updated their information in a distributed deployment. |
本系統中英文摘要資訊取自各篇刊載內容。