基于层次分析法的信息安全风险评估要素量化方法

发布时间：2018-01-25 11:48

本文关键词： 风险评估层次分析法脆弱性偏量判断矩阵　出处：《重庆大学学报》2017年04期 　论文类型：期刊论文

【摘要】：信息安全风险评估是保障信息系统安全的重要基础性工作,但现有风险评估标准和相关研究提供的评估模型和计算方法的评估结果不能有效体现信息系统资产在保密性、完整性、可用性上的不同安全需求和面临的不同风险。利用层次分析法建立风险评估层次分析模型,在借鉴通用脆弱性评分系统指标评价体系基础上改进脆弱性要素量化方法,利用构建的层次分析模型偏量判断矩阵计算"安全事件损失""安全事件可能性"和"风险值"。通过实验验证,与现有方法相比,所提方法的评估结果能够直观体现资产在保密性、完整性和可用性上面临的不同风险,能为制定风险控制措施提供更加准确、合理的建议。
[Abstract]:Information security risk assessment is an important basic work to ensure the security of information systems. However, the evaluation results of the existing risk assessment criteria and the evaluation models and calculation methods provided by relevant studies can not effectively reflect the confidentiality and integrity of information system assets. Based on the different security requirements and different risks in usability, the AHP model of risk assessment is established by using the Analytic hierarchy process (AHP). Based on the index evaluation system of general vulnerability scoring system, the quantitative method of vulnerability factors is improved. The "security event loss", "security event possibility" and "risk value" are calculated by using the bias judgment matrix of the constructed AHP model. The experimental results show that these methods are compared with the existing methods. The evaluation results of the proposed method can intuitively reflect the different risks faced by the assets in the aspects of confidentiality, integrity and availability, and can provide more accurate and reasonable suggestions for formulating risk control measures.
【作者单位】：国网四川省电力公司电力科学研究院;重庆大学信息物理社会可信服务计算教育部重点实验室;
【基金】：国网四川省电力公司科技项目(5219991351VR) 国家自然科学基金资助项目(61472054)~~
【分类号】：TP309
【正文快照】： 2.重庆大学信息物理社会可信服务计算教育部重点实验室,重庆400044)信息安全风险评估是信息安全保障工作的基础性工作和重要环节[1],为信息安全保障体系的建设提供必需的决策依据。信息系统的风险评估可以描述为威胁(外因)利用脆弱性(内因)对资产(主体)产生影响的评价过程。作

【相似文献】