信息价值链视角下的业务信息安全风险评估研究——基于DEA模型与网络层次分析法的综合评价  

Research on Information Security Risk Evaluation of Business Based on the Perspective of Information Value Chain——Based on DEA Model and Analytic Network Process

作　　者：魏修建[1] 陈恒[1] 

机构地区：[1]西安交通大学经济与金融学院,陕西西安710061

出　　处：《情报科学》2015年第8期134-141,共8页Information Science

摘　　要：为提出一种更有效的信息安全风险评估方法,基于信息价值链视角,通过分析数据信息在业务活动流转中"输入—输出"的过程,识别信息价值链增值方向,从而有效识别信息资产,在此基础上引入DEA模型思想,建立数据信息的业务输入-输出指标,确定组织不同业务的数据信息综合增值效率,根据增值效率值确定业务的重要性和业务风险评估顺序;应用网络层次分析法以业务单元为基础进行风险评估,确定风险评价指标之间、不同风险类型之间的关联,明晰组织不同业务单元的风险等级和风险管理顺序。以西安某高校图书馆为实例,验证本方法的可用性。Put forward a more effective information security risk evaluation method,through analysis thevalue chain of business data,;combining with ＂input- output＂ process of the data information in the business unit and distinguish the value direction of information value chain, thus identification the informationassets effectively. on the basis of the introduction of DEAmodel, establishingthe business input- outputindicators of the data information that determine the data value added informationefficiency of the different business unit, so as to determine the order of risk evaluation and different business units.And as a basis of business unit risk assessment in use of ANP,make the correlation between different risks, the riskevaluation index, clearly the different business unit risk degree and risk management order of the organiza-tion. Though the library of University as an example, verify the availability of this method.

关 键 词：信息价值链 业务信息安全 网络层次分析法 DEA模型 

分 类 号：G250.2[文化科学—图书馆学]