An information system safety test quality evaluation method and system

Abstract

The embodiment of the invention provides an information system safety test quality evaluation method and system, and the method comprises the steps: obtaining the test width of an information system safety test according to a system function point coverage rate and a safety demand verification rate in the safety test; According to the core service function threat troubleshooting rate and the edgeservice function threat troubleshooting rate in the safety test, obtaining the test depth of the information system safety test; And according to the test width and the test depth, in combination withthe complexity of the information system, performing calculation to obtain safety test quality evaluation of the information system. The embodiment of the invention provides a method. evaluating thesafety test of the information system; The safety test is evaluated by selecting related data of the safety test and the complexity corresponding to the information system, the selected data is simpleand easy to obtain, formula calculation is simple and convenient, the safety test can be quoted by general enterprises, the completeness of the safety test is ensured, and the traditional safety testis visualized by recording the threat verification process of the safety test.

Description

technical field [0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a method and system for evaluating and calculating the quality of an information system security test. Background technique [0002] During the information system life cycle, before the information system is put into production, most financial institutions will conduct a pre-launch security test on the information system to measure the security of the information system. However, with the normalization of security testing work, there is no practical standard for the quality evaluation of security testing. The results of security testing are mixed, and some systems go online with diseases, resulting in economic losses for enterprises due to system loopholes. [0003] As the supervision of information system security becomes more and more stringent, security testing work is gradually normalized. Some financial institutions such as banks, insurance co...

AI Technical Summary

Problems solved by technology

[0006] The embodiment of the present invention provides a method and system for evaluating the quality of information system security testing, which is used to solve the problems in the prior art that the security testing is uncontrollable, and the testing effect and completeness cannot be guaranteed.

Images