供电企业信息安全风险评估研究

发布时间：2018-11-23 09:13

【摘要】：随着信息系统在供电企业中的应用与发展,供电企业自动化和信息化进程得到极大推动的同时,许多信息安全问题也逐渐凸现出来,进而对企业造成经济损失或不良的社会影响。因此,如何在供电企业中开展科学合理的信息安全风险评估,提升其信息安全水平引起了人们的高度关注。本文以供电企业的信息安全风险评估作为研究对象。在深入研究信息安全风险评估的参考标准、模型及方法的基础上,参照评估标准GB/T20984-2007《信息安全技术信息安全风险评估规范》,提出了基于区间数判断矩阵的模糊信息安全风险评估方法与模型。本论文提出的信息安全风险评估模型分为信息安全事件识别与信息安全风险评估两个阶段。识别信息安全事件就是识别企业资产面临的威胁、可能被利用的脆弱性以及对哪些资产造成了影响。本文参照《信息安全技术信息安全风险评估规范》中的评估标准对企业的资产、脆弱性及其面临的威胁进行分类、赋值,进而,通过分析三者之间的相互关联确定企业中可能发生的信息安全事件。考虑到信息安全风险评估过程中信息的模糊性和不确定性,本文在构造信息安全风险评估层次递阶结构的基础上,引入了区间数判断矩阵,并结合模糊理论对企业的信息安全风险情况进行评估。最后,将本文提出的信息安全事件的识别方法、信息安全风险评估模型应用到A供电企业信息安全风险评估中,依据评估结果对该企业提出相应的安全防护策略建议。
[Abstract]:With the application and development of information system in power supply enterprises, the automation and information process of power supply enterprises are greatly promoted, and many information security problems are gradually emerging. And then cause economic loss or adverse social impact on enterprises. Therefore, how to carry out scientific and reasonable information security risk assessment in power supply enterprises and improve their information security level has aroused great concern. This paper takes the information security risk assessment of power supply enterprises as the research object. On the basis of deeply studying the reference standards, models and methods of information security risk assessment, and referring to the evaluation standard GB/T20984-2007, the information security risk assessment specification of information security technology, This paper presents a fuzzy information security risk assessment method and model based on interval number judgment matrix. The information security risk assessment model proposed in this paper is divided into two stages: information security event identification and information security risk assessment. Identifying information security events is to identify the threat to enterprise assets, the vulnerability that may be exploited, and the impact on which assets are affected. This paper classifies and values the assets, vulnerabilities and threats faced by enterprises according to the evaluation criteria in Information Security Technology Information Security risk Assessment Specification. The information security events that may occur in an enterprise are determined by analyzing their interrelation. Considering the fuzziness and uncertainty of information in the process of information security risk assessment, the interval number judgment matrix is introduced on the basis of constructing the hierarchical structure of information security risk assessment. Combined with fuzzy theory, the information security risk of enterprises is evaluated. Finally, the information security event identification method proposed in this paper and the information security risk assessment model are applied to the information security risk assessment of A power supply enterprise.
【学位授予单位】：华北电力大学
【学位级别】：硕士
【学位授予年份】：2013
【分类号】：F270.7;F426.61

【参考文献】