Network asset value evaluation method and system, medium, equipment and terminal

Abstract

The invention belongs to the technical field of network space security risk assessment, and discloses a network asset value assessment method and system, a medium, equipment and a terminal, and the method comprises the steps: building a business importance index system based on the characteristics of assets on which a business depends and the business, and obtaining the weight of each index through the objective attributes of the assets; evaluating the business importance according to the weight of each index and the value of each business object in each index; the value of the assets is quantified by using the importance of the services and the confidentiality, integrity and availability of the assets, and the values of the same type of services on different assets are effectively distinguished. According to the invention, the requirements of risk assessment and risk management are effectively met, so that the assessment result of asset value is more accurate; a business importance index system is established based on the assets on which the business depends and the characteristics of the business, the value of the same type of business on different assets is effectively distinguished, and the subjective influence is reduced.

Description

technical field [0001] The invention belongs to the technical field of cyberspace security risk assessment, and in particular relates to a network asset value assessment method, system, medium, equipment and terminal. Background technique [0002] In recent years, information security incidents have emerged one after another, which has brought serious impact on people's life and work. Therefore, it is very necessary to carry out risk assessment for information systems. The quantification of asset value is a necessary part of risk assessment, which lays the foundation for the next step of risk assessment and risk management, which is conducive to the smooth development of follow-up work. At present, the traditional method to assess the value of assets is based on the risk level of the three security attributes of confidentiality, integrity and availability, without considering the business importance of the asset. In GB / T31509-2015 Information Security Technology Information...

AI Technical Summary

Problems solved by technology

[0004] (1) The current traditional method of assessing asset value is derived from the risk levels of the three attributes of confidentiality, integrity, and availability, without considering the business importance of the asset

[0005] (2) Information security technology The information security risk assessment specification proposes that the quantification process of asset confidentiality, integrity and availability is prone to subjectivity, and the importance of the business carried by the asset can be considered, and the weighting method can be used to comprehensively obtain The value of the asset, but no specific method is given

[0006] (3) The existing business importance assessment method does not consider the importance of the assets on which the business depends when quantifying the value of assets, does not establish a business importance index system based on the assets on which the business depends and the characteristics of the business itself, and cannot distinguish between different assets that are the same business value

Images