基于安全案例与证据推理的风险评估方法  

An Alternative Methodology for Risk Assessment Based on Assurance Cases and Evidential Reasoning

作　　者：李淼[1] 江常青[1] 张利[1] 

机构地区：[1]中国信息安全测评中心,北京100089

出　　处：《信息安全与通信保密》2010年第4期42-44,共3页Information Security and Communications Privacy

摘　　要：介绍了利用安全案例和证据推理评估信息系统安全风险的新方法。该方法具有两个重要特色:首先,安全案例结构化融合了各种风险要素、相关防护措施以及内在相互影响。其次,该方法便于进行性价比分析以促进有效的安全风险管理。同时,也解释了一些理论概念,并实例讲解了如何使用这个方法。此外,也比较了所提方法与其他现存风险评估方法的优缺点。This paper describes an alternative methodology for the risk assessment of information systems security （ISS） by using Assurance Cses and Evidential Reasoning（ACER）. The approach has the two important features. Firstly, the assurance case incorporates relevant risk factors, related counter measures and their interrelationships in a structured manner. Secondly, the proposed approach facilitates cost-benefit analyses to help promote efficient risk management. The paper tells of the theoretical concepts and provides operational guidance on how to implement the method. Moreover, the proposed method is compared with the other current existing risk assessment approaches,thus to evaluate their weaknesses and strengths.

关 键 词：风险评估 安全案例 证据推理 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]