Risk assessment system and method based on situation awareness alarm

Abstract

The invention describes a risk assessment system based on situation awareness alarm, and the system comprises: an asset assessment module which carries out the recognition of the types of target assets of a target information system, carries out the assessment and assignment of the target assets, and obtains the value score of the target assets; a vulnerability assessment module which is used forchecking vulnerabilities and configuration items involved in target assets of the target information system to obtain vulnerability risk values and configuration item vulnerability values so as to obtain vulnerability scores; a threat evaluation module which is used for identifying and evaluating the threat faced by the target asset based on the situation awareness alarm so as to obtain a threat severity score; and a risk assessment module which is used for obtaining a risk value of the target asset based on the value score, the vulnerability score and the threat severity score so as to obtaina risk level of the target asset of the target information system. Therefore, efficient and accurate risk assessment can be performed on the target assets of the target information system.

Description

Technical field [0001] The present disclosure specifically relates to a risk assessment system and method based on situational awareness warning. Background technique [0002] With the increasing reliance on information systems of government departments, enterprises and institutions, and various industries, the issue of information security has received widespread attention. The use of risk assessment to identify security risks and solve information security problems has been widely recognized and applied. [0003] Information security risk assessment is to use scientific methods and methods to systematically analyze the threats faced by information systems and their existing vulnerabilities from the perspective of risk management, and to assess the degree of harm that may be caused once a security incident occurs. Information system risk assessment can prevent information security risks to a large extent, or control risks at an acceptable level, and maximize the security of infor...

AI Technical Summary

Problems solved by technology

However, these existing risk assessment methods usually have low efficiency or incomplete consideration when analyzing the threats and vulnerabilities faced by information systems, which will lead to inefficient and inefficient process of risk assessment for information systems. The assessment results are not accurate enough

Images