基于风险传播的信息安全评估方法研究与应用

《基于风险传播的信息安全评估方法研究与应用》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、上海交通大学硕士学位论文基于风险传播的信息安全评估方法研究与应用姓名：王巍申请学位级别：硕士专业：软件工程指导教师：杨根兴;蔡立志20081101基于风险传播的信息安全评估方法研究与应用评估是一个重要环节，以确保资源能够集中于风险较大的资产。笔者根据设计的风险评估流程和计算方法，对该的相关人员进行了大量的访谈，引导组织相关人员根据设计确定的分类赋值标准对组织的资产、威胁和脆弱性进行了评估和赋值。最后根据设计的计算方法对组织资产的风险进行了量化评估，得到了较好的量化评估效果，比较客观地反映了组织资产的信息安全风险水平。关键字风险评估，信息安全，风险传播，威胁，脆弱性基于风险传播的信息安

2、全评估方法研究与应用STUDYANDAPPLICATIONOFPROPAGATION-BASEDINFORMATIONSECURITYRISKASSESSMENTABSTRACTTheinformationsecurityproblemisnotonlybasedonthetechnologyanymore,butalsoitisbecomingaglobalproblemwhichisconcerningwithnationsecurity.It'sextremelyurgentfacingtotheworldthathowtomakeajudgmentonwhetherthein

3、fosystemcanreachthesecurityneedsorhowtoenhancethemanagementscientificallyontheinformation.Theriskassessmenthelpstomakethosegoalscometrue.Thesafetyrequirementscanbegeneralizedduringtheprocedureofriskassessment,theriskofinformationwillbemoreunderstandableandtheresourcesandeffortswillbeputonthosem

4、ostriskyinformationassets.Thequestionishowtoassesstheriskmorescientifically.Herethisarticleisresearchingthemaintheoriesonriskassessmentofinfosecurity,frameworks,processingprocedures,regularmethodsonevaluating,andtherelatedsecuritystandards.Accordingtheresearch,thereisadeficiencyinriskevaluation

5、oncurrentexistingtheoriesofinfosecurity,whichistheriskpropagation,whichhasnotbeenconsideredasaimportantelementinthosetheories.Thisarticlewillintroduceanimprovedmethodforriskevaluationbasedonpropagation,whichconsideredboththeriskinitiatedbytheassetandtheriskexpandedfromtheotherassets.Theresultwi

6、llbemuchclosertothefacts.Meanwhileconsideringthevarietyaffectiononconfidentiality、integrity、availabilityoftheassetsmadebytherisk,thenewimprovingformulaused“judgmentmatrix”toidentifythedifferentweightingfunctionofthreatsandvulnerabilityrelatetothedestructivelevelonconfidentiality、integrity、avail

7、abilityofassets.Atthelastpart,theimprovedmethodwillbeappliedonarealprojectappraisal.ThemaintargetofthisprojectistoestablishtheinfosecuritysystembasedonISO27001.Duringtheconstruction,riskevaluationisanimportantsegmentwhichensurewhe