雲端運算服務企業⽤⼾之⾵險管理與雲端運算保險法律問題研析

Abstract

「雲端」是現今網路科技最火紅之名詞，不論係個人日常生活中所使用之App或企業營運應用之軟體、服務皆可能與雲端技術之應用有關。有鑒於近年來網路攻擊、資訊安全事件頻傳，不僅造成企業損失金額節節上升，更使電子化、雲端化後之個人資料保護漏洞浮上檯面，然在企業邁向雲端化的同時，若無相應之風險管理措施，則可能使其暴露於財物損失、營運中斷、法律責任和商譽威脅之風險之中。\n 為此，國外已有將雲端策略和網路安全納入國家政策中並以立法要求資訊安全和個人資料保護，甚至以政策推廣或以軟法要求企業投保網路相關保險者。惟我國除個人資料法有對個人資料之保護外，於資訊安全及雲端服務使用上則尚無完善之規劃，企業在資訊安全、網路安全相關保險之投保率亦極低，顯示企業對此領域之風險意識淡薄。而目前國內市場上可承擔網路風險之保險契約甚少，更遑論針對雲端化之產業推出之商業保險。\n 因此，本文第二章將從雲端運算之技術及基本概念出發，於第三章中剖析企業雲端使用者可能面臨之雲端運算風險、比較其與網路風險之差異，檢視現有建議雲端服務使用者之雲端運算風險管理方法，並探討以保險作為雲端風險管理途徑之妥適性。第四章則參考外國法上曾因網路風險、資訊安全風險等新興風險於傳統保險商品適用上出現之相關法律問題，對照現有網路保險或資訊安全保險之保單條款檢視前述法律問題是否已為妥善解決，並就現行保險不足之處予以改良，試研擬新型雲端保險之契約條款內容。最後於第五章以國內外雲端服務發展現況為出發，綜合本文研究成果提出雲端風險可能產生法律爭議之解套以提升雲端保險之投保意願，並參考國外雲端發展政策及相關保險制度規劃為我國雲端保險市場開展之整體配套措施提供粗淺建議，希冀對我國雲端產業及保險未來發展有棉薄之貢獻。

“Cloud” might be the most popular noun among the information and communication technology field nowadays. From apps in the mobile devices to enterprise softwares, the application of cloud computing techniques is ubiquitous. However, more and more cyber-attacks and data breach events have not only cost businesses a lot but uncovered the issue concerning personal information protection. While embracing the cloud, if enterprises continue to neglect risk management, potential financial loss, business interruption, legal liabilities and the risk of reputation are the risks that enterprise has to deal with. \n Some countries have already incorporated cloud strategy and cyber security into policies, requiring particular threshold of information security and personal information protection by legislation. Some even require business to disclose its insurance policy relevant to its particular facts, circumstances and the presented risks. Nonetheless, in Taiwan, aside from the Personal Information Protection Act, there is no comprehensive policy or strategy on cloud computing or cyber security. The low insured rate of information security and cyber security related insurance also reveals the weakness of risk management of the emerging risks in business. Cyber risk related insurance is also uncommon in the market, not to mention the cloud-computing-targeted business insurance. \n Consequently, this thesis aims to develop a thorough risk management of cloud computing. Starting with the introduction on the basic concept and techniques of cloud computing in Chapter 2, Chapter 3 analyzes the risk that the enterprise cloud service users faces, compares the difference between cyber risk and cloud computing risks, examines current enterprise’s available risk management methods, and discusses the appropriateness of adopting insurance as the risk management of cloud computing. In order to develop a new insurance product for enterprise cloud service users, Chapter 4 studies the related foreign insurance disputes regarding cyber risks and information risks, and examines whether the latest insurance policy had amended the issues, and reforms current cyber insurance into a new cloud insurance. Lastly, based on the present domestic and international market environment of cloud computing service, Chapter 5 summarizes the legal issues discussed in the previous chapter for the purpose of the future development of new cloud insurance market, and map out the cloud computing policy with regard to risk management and insurance as the conclusion of the thesis.