信息安全风险评估研究综述

为全面了解信息安全风险评估的研究现状和前沿技术,介绍了风险评估的理论基础、评估模型、发展历程等相关知识,通过对国内外在信息安全风险评估方面的技术发展状况进行比较,探讨了信息安全风险评估的方法和工具。研究发现,我国在信息安全风险评估方面,还存在评估标准不规范、评估方法可操作性差等问题。应充分借鉴国外成熟经验,用完整的国际标准体系完善我国风险评估标准,用先进的OCTAVE框架改进现有的风险评估方法。

Survey of Information Security Risk Assessment Research

In order to get a comprehensive knowledge to the present situation and the frontier technique of the information security risk assessment, the article introduces in detail the correlative knowledge of the risk assessment, for example: theory, models, present situation and so on, compares the situation of the risk assessment technological developments between domestic and foreign countries, discusses methods and tools of the appraisal. Study shows that nonstandard and poor exercisable in appraisal implementation still exists in home. And it is necessary for us to consummate appraisal standard and improve appraisal methods using the mature foreign experience, for example: entire international standard system, OCTAVE and so on.