面向Web信息系统安全威胁和风险评估分析  

Research on Security Threats and Risk Assessment of Web Information System

作　　者：雷敏[1,2] 刘晓明[3] 张鸿[3] 王勉[1,2] 杨榆[1,2] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]灾备技术国家工程实验室,北京100876 [3]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《北京邮电大学学报》2016年第B06期87-93,共7页Journal of Beijing University of Posts and Telecommunications

基　　金：国家科技支撑计划课题(2015BAH08F02)

摘　　要：将Web信息系统所面临的安全威胁按照威胁所属的类型进行分类,并根据每种威胁的危害程度、发生的概率以及威胁发生后采取措施进行补救的概率等方面对这些威胁进行分级,用模糊综合评价法,构建了一个安全分析的模型,并提出一个通用的Web信息系统安全的分析框架,对Web信息系统进行安全评估分析.An increasing numbers of web information systems are deployed on the Internet to provide service,however,the web information system is facing various security threats,from physical security on bottom layer to communications and operations management,system security,application security and data security. The article gave out classifications of security threats faced by type of threats in web applications and set up grade for each threat according to its extent of danger,probability of occurrence and remediation. The article also uses fuzzy comprehensive evaluation to build a security analysis model aiming at constructing common analysis framework for web information system security assessment.

关 键 词：WEB信息系统 安全评估 风险评估 模糊综合评价法 

分 类 号：TN919[电子电信—通信与信息系统]