信息系统安全风险评估研究

介绍信息系统安全风险分析的概念,分析安全风险评估的基本要素和常见的系统风险评估模式。文章在此基础上,系统性考虑了信息系统所面临的安全威胁、存在的脆弱性以及已经确知的安全控制策略等因素,提出一种信息系统安全风险评估的流程,从而提高风险评估的准确性。提出的安全风险评估流程,综合考虑了信息系统所面临安全威胁、潜在脆弱性以及安全防护确知等因素,可以在一定程度上提高安全风险评估的有效性和准确性。

Study on Security Risk Assessment for Information System

The concept of security risk assessment for information system is given. The essential factors and common methods for security risk assessment are analyzed. Based on those and in consideration of the confronted threats, potential vulnerabilities, and some determined strategies for security control, a process of security risk assessment for information system is proposed. The proposed assessment process could improve the accuracy of security risk assessment, and by comprehensively considering the confronted potential security threats, the existing vulnerabilities and security unascertainable factors, could raise efficiency and accuracy of the security risk assessment.