Based on the risk analysis above, the main considerations for the methods of controlling and
protecting information and privacy in the cloud environment include:
(1)
Establishment of cloud computing security management strategy
By entity, scope of use, and business model, different cloud services business segments
have different security levels. For example, by entities, there are government, enterprise,
and end-user cloud services; by scope, there are public, private, and hybrid clouds; by
business models, there are information content, software, platform, and infrastructure cloud
services. Different security standards and priorities are set based on the different
characteristics and needs of the levels. The security measures should be implemented at
the boundaries of all levels to ensure meeting the security goals. At the same time, full
considerations should be given to the different items and enforcement of laws made and
enforced by the cross-strait authorities in limiting the provision and use of cloud computing
on the Internet.
(2)
Strengthen cloud computing information security governance model, including
the relevant processes and control standards
Initiate the research on cloud computing theory and introduction of standards; classify cloud
information, and establish the specifications for cloud service infrastructure and software
acceptance without leaving a backdoor.; and develop the information security management
specification for cloud services to ensure the healthy development and orderly progress of
cloud computing. From a regulatory perspective, through laws and regulations, the
government can strengthen the control on the access, review and withdrawal of cloud
computing, to supervise the market via specification, and realize the goal of government
regulation of information security of national importance.
(3)
Build reliable cloud computing environments and architecture, and improve
information security system architecture
A reliable cloud services supply chain uses the credibility of the sources to measure the
infrastructure, to compute platform credibility, to verify the credibility of the virtual computing
resources, to support the credibility of the application services, and to ensure the credibility
of the computing environments. A complete cloud computing security model is a security
defense system that is based on identity authentication, uses data security (data encryption)
and authorization (access control) as the core, and uses audit (security audit) as the
auxiliary.
At present, security is one of the most important factors that hinder the development of cloud
computing. To a certain extent, the resolutions on cloud computing security issues may
