考虑控制措施关联性的信息安全风险评估模型  

New Information Security Risk Assessment Model Considering Grey Relevance Between Controls Based on DEMATEL-ANP

作　　者：吴天水[1] 赵刚[1] 王喆[1] 刘换[1] 

机构地区：[1]北京信息科技大学信息管理学院,北京100192

出　　处：《小型微型计算机系统》2013年第10期2324-2328,共5页Journal of Chinese Computer Systems

基　　金：十二五国家科技支撑计划基金项目(2012BAH08B02)资助;国家自然科学基金项目(61272513)资助

摘　　要：考虑到安全目标相互依赖及控制措施之间存在灰色关联性影响等特点,运用DEMATEL-ANP方法和灰色系统理论,建立信息安全风险评估模型.通过对控制措施间不确定性关系进行灰色关联性分析,得出安全风险等级,从而找出需要改善的控制措施,将风险降低在一个可以接受的范围内.选取某高校的若干个信息系统进行实例分析,结果表明该模型在实际应用中是一种有效可行的评估方法.Considering the interdependence of security objectives and grey correlation effects between control measures, this paper presents an information security risk assessment model by using DEMATEL-ANP and grey system theory. The model can be used to get the security risk rating by making grey relation analysis on the uncertainty relationship between control measures and identify the control measures that need to be improved in order to reduce the risk to an acceptable level. A practical application in a college＇s sev- eral information systems is examined, and the analyses results shows that the proposed model is feasible and effective.

关 键 词：风险评估 DEMATEL ANP 灰色关联性 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]