信息安全评估的模型和方法研究

提出了信息系统安全评估及弱点管理的工作模型;明确了信息安全评估中涉及的资产、资产价值、威胁、弱点等基本概念;给出了资产赋值、威胁、弱点量化原则;同时对信息系统安全评估及弱点管理的工作模型,及综合的风险计算模型和公式给以介绍。研究工作旨在为信息安全评估工作和后续的弱点管理工作提供理论依据和参考,以提高风险评估的质量和效果,为企业的信息安全评估提供了支撑平台。同时对安全信息库的建设方式、企事业单位的信息安全评估管理体系的建设提出建议。

Research on the Model and Methods of Information Security Assessment

This paper presents a working model for information system security evaluation and related vulnerability management, defines some basic concepts in information security evaluation such as assets, value of assets, threat and vulnerability, and then puts forward some principles for the quantification of these concepts. Meanwhile, this working model, integrated model for risk calculation, and some related formulas are also introduced in detail. This research, on the one hand, aims to provide theoretical references for information security evaluation and subsequent vulnerability management, to improve the quality of risk assessment and to provide supporting platform for the assessment of enterprises' information security, and on the other, this research can also achieve some beneficial proposals for the construction of enterprises' information security evaluation management system.