基于业务战略的信息资产识别方法

针对信息安全风险评估工作中难以把企业的业务安全映射成资产安全的问题,提出一种基于业务战略的信息资产识别方法,即以信息资源为核心进行资产分类,从支持企业业务战略实现的信息资源出发进行资产识别。以资产完整性赋值为例,采用灰统计评估方法完成了资产完整性赋值过程,其综合评估值能直接用于描述所评估资产安全性属性的等级,对企业开展信息安全风险评估工作具有实用价值。

Method of information property recognition based on business strategies

During information security risk assessment, it is difficult to map the business security into enterprise asset security. In order to solve the problem, a method of information property recognition based on business strategies is proposed.On this method, the information resources are taken as the core assets classification and information asset is identified from the support for realizing the enterprise business strategy. An example of asset integrity is given, using gray statistics to draw reliable results of the asset information security attributes. The comprehensive assessed value can be directly used to describe the evaluation of asset security attributes, which has practical value for enterprises to carry out information security risk assessment.