企业信息安全风险的自评估及其流程设计  

Self-assessment of Information Security Risks in Enterprises and Design of Its Procedure

作　　者：许诚[1] 张玉清[2] 雷震甲[1] 

机构地区：[1]西安电子科技大学经济管理学院,陕西西安710071 [2]中国科学院研究生院国家计算机网络入侵防范中心,北京100039

出　　处：《计算机应用研究》2005年第7期108-110,118,共4页Application Research of Computers

基　　金：国家"863"计划资助项目(2002AA142151);国家计算机网络与信息安全管理中心资助项目(2002研1A007)

摘　　要：首先分析了企业信息安全风险评估的两种模式,即自评估和他评估,指出了它们的优缺点,然后讨论企业自评估的评估要素和评估原则,最后为企业自评估设计了一个实施流程,对该流程的各个环节进行了较为深入的分析,同时对该流程进行评价。Firstly, two kinds of modes of information security risk assessment in the enterprises named self-assessment and other-assessm ent are analyzed, their advantages and disadvantages being pointed out. Then the assessment factors and principles of self-assessment are discussed. Finally , an implementation procedure for self-assessment of enterprises is designed, and each link of this procedure is carried on comparatively deep analysis, at the sa me time, this procedure is appraised.

关 键 词：自评估 风险 风险评估 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]