A method and system for assessing information security risks based on asset dependencies

Abstract

The invention discloses a method and system for assessing information security risks based on asset dependencies. The method includes the following steps: 1: Obtain the scope of assets in the information system to be evaluated, and divide the assets into blocks; Step 2: Identify the assets to be evaluated Threats and vulnerabilities of information systems and the importance of assets, and obtain the importance value of assets, the threat value of threats and the vulnerability value of vulnerabilities; Step 3: use the dependency structure matrix to calculate and construct the security dependency matrix between assets , and use the Delphi method to determine the risk transmission coefficient between assets and construct the risk transmission relationship; Step 4: Calculate the internal risk value of each block according to the risk transmission relationship and the importance, threat value and vulnerability value of the assets, The external risk value and the overall risk value of the information system to be assessed. The present invention can more accurately identify the weak links of the system through the above method, and obtain more reliable information security risk assessment results.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to an information security risk assessment method and system based on asset dependencies. Background technique [0002] With the promulgation and implementation of the "Network Security Law of the People's Republic of China", the protection of key information infrastructure has become an act of the country's will, and has become an important part of the information construction of large enterprises such as energy, telecommunications, and finance. Due to the continuous development of hacking technology, new types of information security vulnerabilities are constantly being discovered, and various types of network information security incidents occur frequently, causing heavy losses to enterprises and the country. The use of information security risk assessment methods to identify and analyze assets, technical means, threats, etc. in the enterprise information system, to di...

AI Technical Summary

Problems solved by technology

[0004] However, the existing information security risk assessment methods mainly do not have the security dependencies between information assets, resulting in inaccurate risk assessment results.

Images