基于层次分析法的信息安全风险评估要素量化方法

信息安全风险评估是保障信息系统安全的重要基础性工作,但现有风险评估标准和相关研究提供的评估模型和计算方法的评估结果不能有效体现信息系统资产在保密性、完整性、可用性上的不同安全需求和面临的不同风险。利用层次分析法建立风险评估层次分析模型,在借鉴通用脆弱性评分系统指标评价体系基础上改进脆弱性要素量化方法,利用构建的层次分析模型偏量判断矩阵计算"安全事件损失""安全事件可能性"和"风险值"。通过实验验证,与现有方法相比,所提方法的评估结果能够直观体现资产在保密性、完整性和可用性上面临的不同风险,能为制定风险控制措施提供更加准确、合理的建议。

An AHP-based quantified method of information security risk assessment elements

Information security risk assessment is an important foundation work for security protection of information systems,but the assessment results of the existing risk assessment criteria and related research models and calculation methods cannot effectively reflect different security needs and risks of the confidentiality,the integrity and the availability of information system assets.In this paper,we used analytic hierarchy process (AHP) to establish a risk assessment analytic hierarchy process model first,then improved vulnerability factor quantitative methods based on the common vulnerability scoring system evaluation index system,and finally used the model's deviator judgment matrix to compute "security incident loss","security event possibility" and "value-at-risk".Experiment results show the proposed method can more intuitively reflect different risks of the confidentiality,the integrity and the availability of assets than conventional methods,and it can provide more accurate and reasonable recommendations for the development of risk control measures.