一种基于业务过程的信息系统安全需求分析方法  

A Business Process-based Method on Security Requirement Analysis of Information Systems

作　　者：余志伟[1] 唐任仲[1] 贾东浇[1] 叶范波 

机构地区：[1]浙江大学,杭州310027

出　　处：《中国机械工程》2007年第4期457-460,共4页China Mechanical Engineering

基　　金：国家863高技术研究发展计划资助项目(2003AA414045);浙江省制造业信息化工程重大科技攻关项目(2003C11010)

摘　　要：为了识别信息系统安全需求,提出一种基于业务过程的信息系统安全需求分析方法。以业务过程安全为中心和目标,通过安全树模型,识别影响业务过程安全的关联资产。应用风险包和风险传递模型技术识别资产安全需求。通过覆盖分析,形成信息系统安全需求列表。最后通过案例简要介绍了该方法的应用。To identify the security requirements of information systems, a business process-based security requirement analysis method was presented. Focused on the business process security, the related assets which affect the business process security were identified by security tree model. The security requirements of assets were identified by risk packet and risk transferring model, and then the security requirements list was formed after coverage analysis. Finally, a case was studied to illustrate the proposed method.

关 键 词：业务过程 信息系统 安全需求 安全树模型 

分 类 号：F270[经济管理—企业管理] TP309[经济管理—国民经济]