Cloud Systems Security: What's Covered and What's Not.

雲端系統安全：涵蓋範圍與未涵蓋範圍

隨著科技發展，越來越多企業將系統遷移至雲端。雲端安全採用「共享責任模型」，即雲端服務供應商與用戶共同分擔安全責任。了解雙方的責任邊界，對於保障企業資訊安全至關重要。

當公司系統在雲端時，安全責任會依循「共享責任模型」在雲端服務供應商與客戶之間劃分。雲端服務供應商負責基礎安全層面，包括堅固的實體數據中心保護、先進的網路防禦（如防火牆、入侵偵測與持續威脅監控）、自動化基礎設施更新、靜態及傳輸中資料加密，以及透過地理分散實現的災難復原。然而，企業仍需自行負責應用層面的安全，包括管理使用者身分與存取權限（IAM）、正確配置雲端服務、維護強化的認證機制、定期檢查存取權限、安裝軟體修補程式、進行弱點評估，以及確保備份與還原策略的可靠性。人為因素（如社交工程與內部人員威脅）及配置錯誤，也不在雲端服務供應商的保障範圍內。明確了解這些責任邊界，對於全面管理雲端安全至關重要。

課程希望讓管理人員理解到雲端服務保安上邊的特點，以及公司內的各類行政措施，採取最安全的策略。

關鍵詞：雲端安全、共享責任模型、雲端服務涵蓋範圍、實體安全、網路安全、資料加密、災難復原、身分與存取管理（IAM）、應用安全、雲端配置錯誤、備份與還原、人為風險、安全最佳實踐。

When migrating company systems to the cloud, security responsibilities are divided between the cloud provider and the customer, following a "Shared Responsibility Model." The cloud provider covers foundational security aspects, including robust physical data center protection, advanced network defenses (such as firewalls, intrusion detection, and continuous threat monitoring), automated infrastructure updates, data encryption at rest and in transit, and disaster recovery through geographic data distribution. However, organizations remain responsible for securing application-level components, managing user identities and access (IAM), configuring cloud services correctly, maintaining strong authentication practices, regularly reviewing access privileges, applying software patches, conducting vulnerability assessments, and ensuring reliable backup and recovery strategies. Human factors, such as social engineering and insider threats, and misconfigurations also fall outside the cloud provider's coverage. Understanding these boundaries is crucial for comprehensive cloud security management.

Keywords: cloud security, shared responsibility model, cloud provider coverage, physical security, network security, data encryption, disaster recovery, identity and access management (IAM), application security, cloud misconfiguration, backup and recovery, human risk, security best practices.