信息安全风险评估工具的设计与实现

文章基于典型的风险评估流程给出了一个有效的风险评估辅助工具的设计方案。该方案中,根据风险评估涉及要素多、过程复杂、不易实施等特点设计了内容丰富的信息库,包括了资产、威胁和脆弱点的分类及分级等重要信息,使用户可有效地对要素进行识别和赋值。同时,方案的设计能够为识别出的威胁提供控制措施,并在评估的最后,按照矩阵法对系统风险值进行计算,使用户清晰地了解信息系统安全状况,并采取有效的控制措施。

Design and Implementation of Information Security Risk Evaluation Tool

Based on the typical risk evaluation flow,this paper advances an effective design project of risk evaluation.In the project,based on the points of risk evaluation as many elements,complex process,difficult implementation and so on,design an ample content information database,include the class and grade information of asset,threat and vulnerability,these can help user to identify and evaluate elements effectively.The project can provide control measures for identified threats,finally,according to the matrix measure,compute the risk value,make user realize the security status of information system clearly and adopt effective control measures.