Asset dependence relation-based information security risk evaluation method and system

Abstract

The invention discloses an asset dependence relation-based information security risk evaluation method and system. The method comprises the following steps of acquiring an asset range in a to-be-evaluated information system, and dividing the asset into blocks; identifying threats, vulnerability and asset significance of the to-be-evaluated information system, and acquiring significance value of the asset, threat value of the threat, and a vulnerability value of the vulnerability; calculating to build a security dependence relation matrix of assets by using a dependence structure matrix, determining a risk conduction coefficient of the assets by using a Delphi method and building a risk conduction relation; and calculating interior risk value and an exterior risk value of each block and overall risk value of the to-be-evaluated information system according to the risk conduction relation and asset significance, threat value and vulnerability value. The method can acquire a weak link ofthe system more accurately, and acquire more reliable information security risk evaluation results.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to an information security risk assessment method and system based on asset dependencies. Background technique [0002] With the promulgation and implementation of the "Network Security Law of the People's Republic of China", the protection of key information infrastructure has become an act of the country's will, and has become an important part of the information construction of large enterprises such as energy, telecommunications, and finance. Due to the continuous development of hacking technology, new types of information security vulnerabilities are constantly being discovered, and various types of network information security incidents occur frequently, causing heavy losses to enterprises and the country. The use of information security risk assessment methods to identify and analyze assets, technical means, threats, etc. in the enterprise information system, to di...

AI Technical Summary

Problems solved by technology

[0004] However, the existing information security risk assessment methods mainly do not have the security dependencies between information assets, resulting in inaccurate risk assessment results.

Images