Method for evaluating information system risk base on multi-element fusion

Abstract

The invention discloses an information system risk assessment method based on multi-factor fusion. The method comprises the following steps: the first step: establishing an information system risk assessment system which comprises a risk assessment result library module (12) and further comprises a risk assessment module (2), a security detection data acquisition module (13), an assets investigation module (8), a questionnaire survey module (9), an assessment library module (11) and an assessment template module (7), wherein the assessment template module (7) is connected with the risk assessment module (2); the second step: determining risk assessment factors; the third step: determining the fusion relationship of the risk assessment factors; the fourth step: performing the risk assessment, wherein the risk assessment refers to the asset assessment, the threat assessment, the vulnerability assessment and the risk calculation. The method achieves the effect of centralized analysis and handling of various security detection results, ensures strong applicability of the system and comprehensive factors for risk assessment, establishes the asset-security threat-security frangibility fusion relation, and ensures remarkable causal relationship of the assessment factors.

Description

technical field [0001] The invention relates to an information system risk assessment method, in particular to an information system risk assessment method based on multi-element fusion. Background technique [0002] Information system risk assessment is a means to understand the network security situation. Through risk assessment, the security threats, security vulnerabilities and security risks faced by assets in the tested object can be assessed. The existing information system risk assessment method is implemented by the risk assessment system, wherein the risk assessment system includes a module for realizing the risk assessment function, a module for realizing the data acquisition function of safety inspection results, a risk assessment result library module, a report module, and a log module; The module of risk assessment function uses security vulnerability to be equal to security risk, and uses qualitative or quantitative calculation methods to draw risk assessment ...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to provide an information system risk assessment method based on multi-element fusion, which can solve the problems of inability to conduct centralized analysis and processing of various security detection result data, poor system applicability, incomplete risk assessment elements, and causal relationship between assessment elements non-prominent problem

Images