企业网络安全预算场景下的风险量化评估探索与研究  

Exploration and Research on Risk Quantitative Assessment in the Scenario of Enterprise Cyber Security Budget

作　　者：张立波 王明博 ZHANG Libo;WANG Mingbo(Zhongan Online,Shanghai 200001,China)

机构地区：[1]众安在线财产保险股份有限公司,上海200001

出　　处：《信息安全与通信保密》2023年第1期87-96,共10页Information Security and Communications Privacy

摘　　要：在日益复杂的网络环境中,互联网上的各个组织和机构经常面临着各种各样的网络安全风险,这些风险事件往往会导致数据泄露和其他严重的损失。为了避免更多的网络安全事件发生,企业必须加强自身的网络安全建设。对于企业管理者来说,如何确定网络安全预算的金额才能使网络安全预算的收益最大化就变成一个很重要的问题。基于戈登—洛布模型,使用网络信息安全风险评估的方法定量分析网络安全预算的收益问题,为企业管理者在确定网络安全预算时提供科学参考。In an increasingly complex cyber environment,organizations and institutions on the Internet are often faced with various cyber security risks,and these risk events often lead to data breaches and other serious losses.In order to avoid the occurrence of more cyber security incidents,enterprises must strengthen their own cyber security construction.For enterprise managers,how to determine the amount of cyber security budget to maximize its benefits becomes a very important issue.Based on the Gordon-Loeb(GL)model,this paper adopts the FAIR(Factor Analysis of Information Risk)method to quantitatively analyze the revenue of cyber security budget and provide scientific reference for enterprise managers in determining the cyber security budget.

关 键 词：网络安全 风险量化 网络安全预算 经济模型 

分 类 号：TP302.1[自动化与计算机技术—计算机系统结构]