基于AHP的信息安全管理测量模型  

Information security management measurement model based on AHP

作　　者：汤永利[1] 徐国爱[1] 钮心忻[1] 杨义先[1] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室信息安全中心

出　　处：《辽宁工程技术大学学报（自然科学版）》2008年第4期575-578,共4页Journal of Liaoning Technical University (Natural Science)

基　　金：国家重点基础研究发展计划(973项目)(2007CB310704);北京市自然科学基金资助项目(4062025)

摘　　要：针对如何建立一个合适的风险模型来测量与评估信息系统的风险的问题,提出了一种融合定性分析与定量计算的测量建模方法,从信息安全管理测量的实践出发,采用层次分析法详细给出了测量模型、测量要素、测量指标、测量方法以及测量实施流程。在具体实施过程中,结合标准ISO/IEC 27002体系结构和层次分析法各自的特点,确定了具体信息系统的测量要素和测量指标,同时考虑信息系统等级保护的要求,依据建立的测量模型来计算信息系统安全状况,最后依据判决准则综合评价所测目标系统的安全管理。该方法应用于信息系统管理测量与评估的实践,为信息系统风险测量提供了一种新的思路。In view of the problem about how to build an appropriate risk model to measure and estimate the risk of information system, a method of measurement modeling combined qualitative analysis with quantitative computation is proposed. From the point of practice view of information security management measurement （ISMM）, the model, factors, indices, means and implementation flow are also given in detail. With the implementation process of ISMM, measurement factors and indices for the concrete application of information system can be determined by system structure of ISO27002 and the analytic hierarchy process （AHP）. According to the different requirements of hierarchy protection, measurement model is used to estimate the security condition of information system and decision rules are introduced to realize the overall evaluation of security management. This method is applied into information security management test and evaluation, which provides a new method for information system risk measurement.

关 键 词：信息安全管理测量 测量建模 层次分析法 等级保护 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]