Risk assessment algorithm for information system

Abstract

The invention discloses a risk assessment algorithm for an information system. According to the GB / T20984-2007 standard, a correlation between the assessment factors of assets, the assessment factors of vulnerability and the assessment factors of threats of the information system is established, a safety assessment indicator system is achieved, and 24 pairs of risk relations are achieved. The 24 pairs of achieved risk relations are substituted into a formula (1), an asset comprehensive value A is obtained through calculation. According to asset comprehensive value A and a vulnerability value V, the comprehensive value F of the loss caused by security events is worked out. According to the vulnerability value V and a threat value T, a security event possibility comprehensive value L is worked out. The comprehensive value F of the loss caused by the security events and the security event possibility comprehensive value L are substituted into a formula (2), and then a risk comprehensive value R is worked out and obtained. The risk assessment algorithm for the information system can eliminate the influence caused by the facts that assessment factor selection is unreasonable and risk correlation analysis cannot objectively reflect the system state, and improve the objectivity and the accuracy of risk assessment.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to an information system risk assessment algorithm. Background technique [0002] Information security analysis and evaluation is to use scientific methods and means from the perspective of risk management to systematically analyze the threats faced by information systems and their existing vulnerabilities, evaluate the degree of harm that may be caused by security incidents, and propose targeted defense measures. Threat prevention countermeasures and rectification measures provide a scientific basis for preventing and resolving information security risks, controlling risks at an acceptable level, and maximizing information security. [0003] At present, GB / T 20984-2007 introduces two risk value calculation methods, matrix method and multiplication method. [0004] Security risk refers to the establishment of the possibility of security incidents caused by threats exploiting vul...

AI Technical Summary

Problems solved by technology

[0006] introduced the basic process and principle of risk analysis in GB / T 20984-2007, by identifying and assigning values ​​to the three major elements (assets, vulnerabilities, threats) , the multiplication or matrix method is used to calculate the risk value, but the attributes of each element are not refined and decomposed, and it is difficult to quantify the operation in risk assessment practice

The current evaluation algorithm is highly subjective, which affects the accuracy of the evaluation results

Images