信息系统安全风险评估方法的研究

本文根据信息系统风险评估的基本要素, 通过对信息系统的现状分析, 提出了一种基于脆弱性和威胁分析相结合的定量风险评估方法. 该方法建立了相应的风险计算模型, 通过脆弱性分析, 威胁识别, 后果属性及其权重计算等多个步骤对信息系统的安全风险进行定量分析计算得到信息系统安全评估风险值, 提高了信息系统风险评估的客观性和可度量性.

Research on security risk assessment method based on vulnerability and threat analysis

Based on the analysis of information systems and the basic elements of risk assessment,a quantitative security risk assessment method which is a combination of vulnerability and threat analysis is proposed.The risk computation model is constructed.Through a number of steps,such as the vulnerability analysis,threat identification,the consequences of property and weights calculation,a security risk assessment value is obtained.It enhances the objectivity and measurability of the risk assessment process.