Information system security performance assessment method

Abstract

The invention discloses an information system security performance assessment method. The method comprises following steps: carrying out leveled scoring to the security level, the operating maintenance level, the confidentiality, the integrity and the availability of an information system; classifying the assets subordinate to the information system; carrying out leveled scoring to the confidentiality, the integrity and the availability of the assets; discovering the vulnerabilities of the information system; obtaining the asset classes to which the vulnerabilities belong; carrying out vulnerability scoring to the vulnerabilities; calculating the security risk values of all vulnerabilities of the information system; and finishing assessing the information system security performance. According to the method of the invention, the information system and the assets subordinate to the information system are classified and scored; the security assessment is carried out to the information system through combining the vulnerability of the vulnerabilities and the assets to which the vulnerabilities belong; the security of the information system can be reacted visually in real time; the information system is assessed by a quantitative calculation method; the assessment result is visual and reliable; and the calculation method is simple and scientific.

Description

technical field [0001] The invention specifically relates to a method for evaluating the security performance of an information system. Background technique [0002] With the development of the country's economy and the improvement of people's living standards, data information has penetrated into thousands of households. Now people's basic necessities of life are inseparable from data information. The advent of the data age and the information age has greatly facilitated people's lives. [0003] Information system is a man-machine integration system for the purpose of processing information flow, which is composed of computer hardware, network, communication equipment, computer software, information resources, users and certain protocols. The security of information system is directly related to the security of data information and the operation security of information system. [0004] At present, the security assessment methods of information systems are mostly static as...

AI Technical Summary

Problems solved by technology

[0004] At present, the security assessment methods of information systems are mostly static assessments for specific information environments, which cannot grasp the information of information systems in real time and the risks faced by the environment in which information systems are located.

In addition, the existing evaluation methods of the Ministry of Security mainly focus on the overall security environment of information assets and information systems, and their focus is on the overall risk of the information system, and it is impossible to conduct risk assessment on a single information system object or element

At the same time, the evaluation results of the existing evaluation methods are relatively abstract, and cannot intuitively reflect the risks faced by the information system and its components.

Images