基于等级测评的系统安全保护能力量化评价方法

采用层次分析法构建保护能力的评价指标体系,并以此为基础层层汇总计算各措施层指标的合成权重,作为保护能力得分量化的基础。同时,还在现有等级测评的基础上,创新性提出从“正反”两个不同的角度来度量信息系统的安全状况,安全保护能力评价结合了正向的保护状况和反向的风险情况进行综合判定。

Quantitative Assessment Method of Information System Security Capability Based on Classified Protection Testing and Evaluating

Evaluation Index System of information system protection capabilities was built based on AHP, which was used as the basis to calculate the various layers weights as the synthesis weight of the index of measure layer, and used as the foundation of quantifying security capability score. Meanwhile, based on the existing classified protection testing and evaluating, a new idea was put forward to measure the information system security protection situation from the "pros and cons" of two different views. Information system security capability was evaluated and comprehensively judged by combining with the positive evaluation of the protection situation and reverse risks.