基于等级保护体系的信息安全风险评估方法研究  

Evaluation Method of Infosec Risk based on Classified Protection System

作　　者：张元天 刘福强[1] 陈泱[2] 

机构地区：[1]海军装备研究院 [2]91917部队

出　　处：《信息安全与通信保密》2016年第8期78-81,86,共5页Information Security and Communications Privacy

摘　　要：信息安全风险评估指标体系的建立与量化分析是进行评估的关键问题。针对这一问题,文中提出了一种基于等级保护体系的信息安全风险评估方法。该方法依据等级保护的相关规定建立新的指标体系,利用AHP方法建立基于等级保护指标的风险评估量化模型,并设计算法完成对模型的计算和分析。实验结果显示该评估方法在降低了人为主观因素的前提下能够计算信息系统的风险值,对系统安全风险的评估有一定的实用价值。The establishment and quantification of index system is a key issue for infosec risk assessment. In view of this problem, an evaluation method of infosec risk based on classified protection system is proposed. The method, in accordance with the reh,vant provi- sions of classified protection establishes a new index system, and with AHP, constructs a risk assessment quantitative model based on the classified protection index, and with the designed algorithm, completes the calculation and analysis of the model. Experimental re- suits indicate that this method can calculate the risk value of information system on the premise of reducing the subjective factors, and this is of significant value for dividing of security risk levels.

关 键 词：信息安全 安全评估 等级保护 AHP方法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]