信息安全风险评估ASMI方法论的应用研究  

Application Research of ASMI Methodology for Information Security Risk Assessment

作　　者：陈阳怀[1] 

机构地区：[1]北京航空航天大学软件学院,北京100091

出　　处：《信息安全与通信保密》2011年第4期85-89,共5页Information Security and Communications Privacy

摘　　要：基于信息安全风险评估工作的发展现状,为进一步提高其科学性和实践价值,通过综合分析信息安全风险评估相关标准和实践方法,建立以追求信息安全客观风险为目标的信息安全风险评估思想,并构建了由安全现状(Aactuality)、参考基准(Standard)、测量模型(Model)和工程实施(Implementing)4个方面组成的信息安全风险评估方法论(简称ASMI方法论)。同时,还深入分析了ASMI方法论的组成要素、相互关系、应用方法和实践价值。该方法论有望对信息安全风险评估业务、信息安全保障体系建设和信息安全标准体系的协调发展起到积极的促进作用。With the development of information security risk assessment work and for further improving its scientism and practical value,the idea of safety risk evaluation aiming at pursuing objective risk of information security is established through comprehensive analysis of relevant standards and practical methods,including the safety risk assessment methodology composed of four parts：safety actuality,reference standard,measurement model and engineering implementation（abbreviated as ASMI Methodology）. Also,this paper further analyzes the ASMI Methodological elements and its interrelationship,application method and practical value. This methodology is expected to play a positive role in the service of information safety risk evaluation,the establishment of information safety assurance system,and the development of information safety standard system.

关 键 词：信息安全 风险评估 ASMI方法论 信息系统 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]