信息安全风险管理绩效研究  

Study on Performance of Information Security Risk Management

作　　者：卢志刚[1,2] 潘林[1,2] 刘宝旭[1] 许榕生[1] 蒋文保[3] 

机构地区：[1]中国科学院高能物理研究所计算中心,北京100049 [2]中国科学院研究生院,北京100049 [3]北京信息科技大学,北京100101

出　　处：《计算机科学》2010年第6期40-42,55,共4页Computer Science

基　　金：国家科技支撑计划重点项目(2009BAH52B06);北京市自然科学基金面上项目(4072010)资助

摘　　要：分析了当前风险管理的现状和所面临的问题,并通过风险确认,提出了一个风险管理效率判别模型,以对风险管理方案进行判别,找出最佳的风险管理方案。通过分析进一步指出了基于信息资产提供业务的风险管理投资和安全事件损失的联系,并对其有效性进行了验证。实验结果表明,此方法是行之有效的。Analyzed the situation and likely problems of the current risk management through affirming the current risk,combined with analysis of financing final accounts, and then put forward a systematic and normative differentiating model for the efficiency of risk management to distinguish the risk management projects from which found out the opti- mal one. Then pointed out the link between the investment of risk management and the loss of security incidents through further analyzing base on business, and gave out the verification of its effectiveness, The result of verification shows that this model is effective.

关 键 词：信息安全 风险管理 方案决策 绩效 

分 类 号：F270.7[经济管理—企业管理]