Method and system for evaluating risk of information system

Abstract

The invention discloses a method and system for evaluating a risk of an information system. The method comprises the steps of obtaining a safety risk report of the information system; determining the values of basic elements of the risk of each evaluated object in the information system according to the safety risk report, wherein the basic elements of the risk at least include three basic elements of assets, threats and vulnerability; for any to-be-evaluated object, determining the loss caused by the risk according to a vulnerability value of the to-be-evaluated object and an asset value of the to-be-evaluated object; determining the possibility of the risk according to the vulnerability value of each to-be-evaluated object and the asset value of each to-be-evaluated object; and multiplying the loss caused by the risk and the possibility of the risk and then extracting a root to obtain the risk value of each to-be-evaluated object.

Description

technical field [0001] The invention relates to the field of network security, in particular to an information system risk assessment method and system. Background technique [0002] For computer systems, due to defects in the specific implementation of hardware, software and / or protocols in the computer system or system security policies, attackers can access or destroy the computer system without authorization. These flaws are also known as computer vulnerabilities. Some computers on the network have network threats due to vulnerabilities. With the rapid development of computer networks, computer systems that provide various services through computer networks are becoming more and more popular, and the losses caused by the loopholes in these computer systems are also greater. [0003] The current traditional risk assessment method is usually to establish a risk assessment model to conduct qualitative analysis of the computer system. In reality, an assessment team compose...

AI Technical Summary

Problems solved by technology

[0003] The current traditional risk assessment method is usually to establish a risk assessment model to conduct qualitative analysis of the computer system. In reality, an assessment team composed of IT technical support members and business owners conducts qualitative assessment of risk levels, which often leads to threat and vulnerability analysis, etc. Factors are not fully understood; in addition, when the amount of risk assessment increases, the risk assessment results will become unreliable due to subjective factors

Since the various existing risk assessment mechanisms are often subjective, the assessment results vary from assessor to assessor and often become unusable

Images