Device and method for risk assessment of information system based on fault tree

Abstract

The invention provides an information system risk assessment method based on a fault tree. The method comprises the steps that a customer information leakage event is used as a top event, and an intermediate event and a basic event are determined to establish the fault tree; and risk assessment is carried out on the information system based on a fault tree analysis method. The invention further provides an information system risk assessment device based on the fault tree. According to the information system risk assessment device and method based on the fault tree, universal quantitative analysis is realized; the assessment accuracy and stability are improved; the device and method facilitate risk positioning and hierarchical protection.

Description

Technical field [0001] The present disclosure relates to the field of information security, and more particularly to information system risk assessment devices and methods based on fault trees. Background technique [0002] In large information systems, such as financial information systems, often there is a massive customer information. With the rapid development of computer applications and Internet technology, information leakage is also more prominent, and safety information leaks may lead to huge economic losses. At the same time, information leakage will cause privacy violations, fake and metal fraud, etc. Brings adverse social impact. Therefore, how to risk assessment of information systems has always been the focus of information system security technology. [0003] However, in the field of information system security, it is mainly an evaluation of the main body of the operational risk of the information system; in addition, although there is a production safety assessmen...

AI Technical Summary

Problems solved by technology

[0003] However, at present, in the field of information system security, the main body of the assessment is the operational risk of the information system; in addition, although in the field of industrial production security assessment, there are production security assessments using fault tree analysis methods, but for customer information leakage risk However, effective, accurate and quantitative evaluation devices and methods have not yet appeared

[0004] That is to say, in the field of customer information system risk assessment, the design of existing customer information systems and the risk of customer information leakage of information systems by users generally adopt subjective qualitative judgment methods, which only stay on the intuitive feeling and lack of objectivity. Sexuality and accuracy, lack of effective quantification methods

Images