基于BS7799标准风险评估方法的设计与应用  

Design and Application of Risk Assessment Method Based on BS7799 Standard

作　　者：聂晓伟[1] 张玉清[2] 杨鼎才[1] 韩权印[2] 

机构地区：[1]燕山大学信息科学与工程学院,秦皇岛066004 [2]中科院研究生院国家计算机网络入侵防范中心,北京100043

出　　处：《计算机工程》2005年第19期70-72,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2002AA142151);国家信息关防与网络安全保障持续发展计划基金资助项目(2002-研1-A-007)

摘　　要：分析了BS7799的结构特点,进而研究了当前主要的风险评估方法,旨在探讨一套能够对BS7799标准进行改进、定性和定量相结合的风险评估方法,以克服单一评估方法的不足。在具体设计风险评估方法时,采取故障树和风险模式影响分析相结合的方式对BS7799进行了实施与应用。并将该方法在实际的风险评估工具的设计中进行实现,收到了较好的效果,从而验证了方法的科学性和可行性。This paper analyses the structure characteristics of BS7799 and main methods for risk assessment currently, which aiming to explore an improving, combining associative observation with quantity risk assessment method to conquer the disadvantage of single risk assessment method. As designs a risk assessment method, the paper adopts method combining with fault tree analysis and risk model contribution analysis to put into effect and applies BS7799. The method is realized in the practical design of risk assessment tool, which gains good effectiveness and proves its scientific and feasibility.

关 键 词：风险评估 BS7799 风险分析方法 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]