Security assessment method based on information security risk assessment

Abstract

The invention discloses a security assessment method based on information security risk assessment, relates to the technical field of information security assessment, and aims at respectively calculating accurate risk values for each service, system and asset of a user unit according to a set of data input by a user so as to provide a basis for a subsequent risk assessment conclusion. According to the method, the work efficiency of risk assessment work completed by risk assessment personnel is greatly improved, the accuracy of calculating risk values of all businesses, systems and assets is improved, data archiving in the whole process of risk assessment is achieved, and the risk assessment personnel can conveniently provide rectification suggestions and data backtracking work for existing safety risk problems. According to the method, an automatic processing flow is used, the requirements of an actual risk assessment project are met, and the assessment efficiency is improved; the method provides a more objective evaluation calculation process, automatically generates corresponding risk value scores and risk evaluation comments, reduces the influence of human factors, and guarantees the accuracy of a risk evaluation result.

Description

Technical Field

[0001] The present invention relates to the technical field of information security assessment, and in particular to a security assessment method based on information security risk assessment. Background Art

[0002] Information security risk assessment is an important technical background in the field of computer applications. With the rapid development of computer technology, information acquisition has become increasingly convenient, but information security issues have also become increasingly prominent. In order to ensure information security, a comprehensive risk assessment of the information system is required. Information security risk assessment is mainly based on relevant standards and management specifications, and analyzes the asset value, potential threats, weak links and protective measures taken by the information system to determine the probability of security incidents and the possible losses, and propose corresponding risk management measures. This technology has been widely used at both the enterprise and national levels and is an important means to ensure information security.

[0003] At present, in information security risk assessment, it is necessary to conduct comprehensive and accurate risk identification and assessment of each business, system and asset in combination with the actual situation of the user unit. However, in this process, because it is necessary to consider the mitigation effect of existing security measures, it is also necessary to consider the relationship and value weight between each specific business, system and asset. It is often time-consuming and labor-intensive to evaluate only based on manual means, thus affecting the efficiency of risk assessment. In addition, traditional risk assessment methods often rely on the experience and intuition of the assessor, which is highly subjective, which may cause the final assessment results to be interfered with by human factors and thus reduce accuracy.

[0004] Therefore, a security assessment method based on information security risk assessment has become an urgent problem to be solved. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a security assessment method based on information security risk assessment, which calculates accurate risk values ​​for each business, system and asset of the user unit according to a set of data input by the user, thereby providing a basis for subsequent risk assessment conclusions. The work efficiency of risk assessors in completing risk assessment tasks is greatly improved, the accuracy of calculating the risk values ​​of each business, system and asset is improved, and data archiving of the entire risk assessment process is realized, which facilitates risk assessors to propose rectification opinions and data backtracking for existing security risk issues. The set of data input by the user includes sorted business data, system data, asset data, the relationship between the system and the business, the relationship between the asset and the business, the relationship between the asset and the system, the system-related detection item guide, the asset-related detection item guide, vulnerability scanning data, system detection item inspection results, asset detection item inspection results, the impact of existing security measures and the ease of vulnerability being exploited, and system / asset assignment.

[0006] To solve the above technical problems, the present invention provides a technical solution: a security assessment method based on information security risk assessment, comprising the following steps:

[0007] S1. Enter business information data and system information, where the system information includes CIA values ​​and associated business names. After entering the system information, the user calculates the asset value of each system based on the CIA values, and establishes an association between the business and the system based on the business name associated with the system, and searches for the associated system in the business information table.

[0008] S2. Enter asset information, where part of the asset information includes CIA values ​​and associated business names and associated system names. After entering the asset information, the user calculates the asset value of each asset based on the CIA values, and establishes an association relationship between the asset and the business based on the business name associated with the asset, and establishes an association relationship between the asset and the system based on the system name associated with the asset.

[0009] S3. Create a risk assessment project for the filled systems and assets, and upload the vulnerability scan data in the risk assessment project;

[0010] S4. Create corresponding verification records for systems and assets. The system and asset information filled in by the user includes the detection item guide. The user selects the system or asset for information security risk assessment and refers to the relevant standards. When the user creates verification records for these systems and assets, a blank verification record is automatically created based on the verification item content of the detection item guide corresponding to the system / asset for the user to fill in.

[0011] S5. Enter the verification records and verification results. The user fills in the verification records and verification results of the system or asset in each verification item based on the actual situation;

[0012] S6. Enter the detection problem summary table. The user assigns values ​​to each risk point in the detection problem summary table generated in step S5. The three fields are mainly assigned values, including the ease of vulnerability exploitation, the vulnerability impact, and the threat value.

[0013] S7. Calculate the risk value of a single risk point. The main steps are:

[0014] Step S7-1: Calculate the possibility of a security incident according to the ease of exploitation of the vulnerability of the risk point and the threat value, by taking the square root of the product of the two and rounding to zero decimal places;

[0015] Step S7-2: Calculate the loss caused by the security incident according to the impact degree of the risk point and the asset value generated in step S1 or step S2, by taking the square root of the product of the two and rounding to zero decimal places;

[0016] Step S7-3: Calculate the risk value of a single risk point using the results of step S7-1 and step S7-2. The calculation method is to take the square root of the product of the two and round off to retain 0 decimal places.

[0017] S8. Integrate existing safety measures to recalculate risk values. The main steps are:

[0018] Step S8-1: Review existing security measures for each risk point, mainly referring to two indicators: one is the ease of vulnerability being exploited, and the other is the impact. If the existing security measures do not reduce the security risk, the original risk value remains unchanged. If there is an indicator whose existing security measures reduce the security risk, the value of the indicator becomes half of the original value, rounded to 0 decimal places;

[0019] Step S8-2: Based on the latest vulnerability exploitation difficulty and impact calculated in step S8-1, re-execute the operation of step 7 to calculate the latest risk value;

[0020] S9. Calculate the risk value of system components and unit assets by adding up the risk values ​​of all verification items corresponding to the assets and dividing the sum by the total number of verification items to obtain the average value, rounding to zero decimal places;

[0021] S10. Calculate the business risk value. The main steps are:

[0022] Step 10-1: Obtain the business information data entered in step S1, and filter out the assets and systems associated with the business;

[0023] Step 10-2: respectively obtaining the assets associated with the business and the risk value generated by the system in step S9 and the asset value generated in step S2;

[0024] Step 10-3: Normalize the asset values ​​and calculate the business-related asset weights of each asset;

[0025] Step 10-4: Multiply the business-related asset weight corresponding to each asset or system by the system component and unit asset risk value generated in step S9, then sum the multiplication results of all assets and systems, round off to 2 decimal places, and obtain the business risk value;

[0026] S11. Calculate the system asset risk value. The main steps are:

[0027] Step 11-1: Obtain the information data entered in step S1, and filter out the assets associated with the system and the data of the current system;

[0028] Step 11-2: respectively obtaining the assets associated with the system and the risk value generated by the current system in step S8 and the asset value generated in step S2;

[0029] Step 11-3: Normalize the asset value and calculate the system-related asset weight of each asset and the current system;

[0030] Step 11-4: Multiply the system-related asset weight corresponding to each asset and the current system by the system component and unit asset risk value generated in step S9 to obtain the multiplication result of each asset and the current system, then sum the multiplication results of all assets and the current system, round off to 2 decimal places, and obtain the system asset risk value;

[0031] S12. Generate risk assessment conclusions based on the calculated business risk values ​​and system asset risk values, and automatically generate corresponding risk assessment conclusions for each business and system.

[0032] Furthermore, the CIA values ​​assigned in step S1 and step S2 are the scores of the assets in terms of confidentiality, integrity, availability, business carrying capacity, and business importance. Each score has five levels, namely: very high - 5 points, high - 4 points, medium - 3 points, low - 2 points, and lowest - 1 point.

[0033] The asset value is obtained by adding up the scores assigned by the CIA and finding the average, and rounding the result to 0 decimal places to obtain the asset value.

[0034] Furthermore, in step S4, relevant standards involved in the safety risk assessment object are pre-stored to support users to upload and enter new standard file data. When filling in the inspection item instruction field, the user can select the relevant standard file.

[0035] Furthermore, in step S5, the verification results are divided into compliance and non-compliance. If the verification result of a certain verification item is non-compliance, it is considered to be a risk point; the verification items with non-compliance results are automatically screened out for each asset and system, and added to the detection problem summary table, as well as the risk points where vulnerabilities exist in the asset or the system in the vulnerability scanning data, which are also added to the detection problem summary table.

[0036] Furthermore, in step S6, the data source of the threat assignment is the threat identification result table entered by the user. When the user performs a risk assessment operation, the collected threat intelligence and information will be classified, and a threat identification result table will be output, including the corresponding threat behavior and threat assignment; when the user assigns a threat to a risk point, the threat behavior corresponding to the risk point is selected, and the threat assignment of the threat behavior is automatically associated with the risk point, thereby completing the assignment operation.

[0037] Furthermore, the risk value mentioned in step S7 and step S8 refers to the risk assessment score of a certain system or a certain asset under a certain verification item.

[0038] Furthermore, the normalization processing in step S10-3 refers to summing up the asset values ​​corresponding to each asset and system associated with the business, and then dividing the asset value of each asset or system by the sum of the asset values ​​to obtain the business-related asset weight corresponding to each asset or system, ensuring that the sum of all asset weights associated with the business is equal to 1.

[0039] Furthermore, the normalization processing in step S11-3 refers to summing up the asset value of each asset associated with the system and the asset value corresponding to the current system, and then dividing the asset value of each asset or the current system by the sum of the asset values ​​to obtain the system-related asset weight corresponding to each asset and the current system, to ensure that the sum of all asset weights associated with the system is equal to 1.

[0040] Furthermore, the risk assessment conclusion is divided into five levels. When the risk value ranges from 4.5 to 5, the conclusion is very high; when the risk value ranges from 3.5 to 4.49, the conclusion is high; when the risk value ranges from 2.5 to 3.49, the conclusion is medium; when the risk value ranges from 1.5 to 2.49, the conclusion is low; when the risk value ranges from 1 to 1.49, the conclusion is very low.

[0041] The advantages of the present invention compared with the prior art are:

[0042] 1. The present invention uses an automated processing flow to meet the needs of actual risk assessment projects, greatly shortening the time and resources required for assessment and improving assessment efficiency;

[0043] 2. The present invention provides a more objective evaluation and calculation process. Through a set of standardized data input by the user, the corresponding risk value score and risk evaluation comments can be automatically generated, reducing the influence of human factors and ensuring the accuracy of risk assessment results;

[0044] 3. The present invention provides traceable management of the entire process data of the risk assessment project, realizes the archiving of data records throughout the project cycle, and facilitates quality reviewers to review the risk assessment project and make corresponding rectification suggestions for problem points. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flow chart of a security assessment method based on information security risk assessment of the present invention. DETAILED DESCRIPTION

[0046] The following is a further detailed description of a security assessment method based on information security risk assessment of the present invention in conjunction with the accompanying drawings.

[0047] Combined with Figure 1 The specific implementation process of a security assessment method based on information security risk assessment of the present invention is as follows:

[0048] A security assessment method based on information security risk assessment comprises the following steps:

[0049] S1. Input of business information data and system information, wherein the system information includes CIA assignment and associated business name. After the user completes inputting the system information, the present invention can calculate the asset value (Vc) of each system according to the CIA assignment, and at the same time, the association relationship between the business and the system can be established according to the business name associated with the system, and the associated system can be queried in the business information table;

[0050] S2. Inputting of asset information, wherein a part of the asset information includes CIA assignment and associated business name and associated system name. After the user finishes inputting the asset information, the present invention can calculate the asset value (Vc) of each asset according to the CIA assignment, and establish the association relationship between the asset and the business according to the business name associated with the asset, and establish the association relationship between the asset and the system according to the system name associated with the asset;

[0051] The CIA values ​​mentioned in step S1 and step S2 are the scores of the assets in terms of confidentiality, integrity, availability, business carrying capacity, and business importance. Each score has five levels, namely: very high (5 points), high (4 points), medium (3 points), low (2 points), and lowest (1 point).

[0052] The asset value (Vc) mentioned in step S1 and step S2 is obtained by adding up the scores assigned by the CIA and averaging the result, rounding the result to 0 decimal places to obtain the asset value (Vc).

[0053] S3. Create a risk assessment project for the filled systems and assets, and upload the vulnerability scan data in the risk assessment project;

[0054] S4. Create corresponding verification records for systems and assets. The system and asset information filled in by the user includes the detection item guide. The user needs to select the relevant standards that should be referred to when the system or asset is evaluated for information security risks. When the user creates verification records for these systems and assets, the present invention can automatically create a blank verification record for the user to fill in according to the verification item content of the detection item guide corresponding to the system / asset;

[0055] In the present invention, relevant standards involved in the security risk assessment object have been pre-stored, and users are also supported to upload and enter new standard file data. When filling in the inspection item instruction field, the user can select the relevant standard file from the present invention.

[0056] S5. Enter the verification records and verification results. The user fills in the verification records and verification results of the system or asset in each verification item based on the actual situation;

[0057] Among them, the verification results are divided into compliance and non-compliance. If the verification result of a certain verification item is non-compliance, it is considered a risk point. The present invention will automatically filter out the verification items with non-compliance results for each asset and system, add them to the detection problem summary table, and the risk points including the vulnerability of the asset or the system in the vulnerability scanning data are also added to the detection problem summary table

[0058] S6. Input of the detection problem summary table. The user assigns values ​​to each risk point in the detection problem summary table generated in step 5. The main fields to be assigned values ​​are the difficulty of vulnerability exploitation (Av), the vulnerability impact (Vc), and the threat value (T).

[0059] The data source of the threat assignment (T) is the threat identification result table entered by the user. When the user performs a risk assessment, the collected threat intelligence and information will be classified and a threat identification result table will be output, including the corresponding threat behavior and threat assignment (T). When the user assigns a threat value to a risk point, the threat behavior corresponding to the risk point is selected. The present invention automatically associates the threat assignment (T) of the threat behavior with the risk point, thereby completing the assignment operation;

[0060] S7. Calculate the risk value (Rc) of a single risk point. The main steps are:

[0061] Step S7-1: Calculate the probability (L) of a security incident according to the vulnerability of the risk point being exploited (Av) and the threat value (T). The calculation method is to take the square root of the product of the two and round off to zero decimal places.

[0062] Step S7-2: Calculate the loss (F) caused by the security incident according to the impact degree (Vc) of the risk point and the asset value (Vc) generated in step S1 or step S2, by taking the square root of the product of the two and rounding to zero decimal places;

[0063] Step S7-3: Calculate the risk value (Rc) of a single risk point using the results of step S7-1 and step S7-2. The calculation method is to take the square root of the product of the two and round off to retain 0 decimal places.

[0064] S8. Integrate the existing safety measures to recalculate the risk value (Rc). The main steps are:

[0065] Step S8-1: Review existing security measures for each risk point, mainly referring to two indicators, one is the ease of vulnerability exploitation (Av), and the other is the impact (Di). If the existing security measures do not reduce the security risk, the original risk value (Rc) remains unchanged. If there is an indicator whose existing security measures reduce the security risk, the value of the indicator becomes half of the original value, rounded to 0 decimal places;

[0066] Step S8-2: Based on the vulnerability exploitation difficulty (Av) and impact (Di) calculated in step S8-1, the operation of step S7 is performed again to calculate the latest risk value (Rc);

[0067] The risk value (Rc) mentioned in step S7 and step S8 refers to the risk assessment score of a certain system or a certain asset under a certain verification item.

[0068] S9, calculating the risk value (Ra) of system components and unit assets. The present invention automatically adds up the risk values ​​of all verification items corresponding to the assets, divides the sum by the total number of verification items to obtain an average value, and rounds off to retain 0 decimal places;

[0069] S10. Calculate the business risk value (Rb), the main steps are:

[0070] Step S10-1: Obtain the business information data entered in step S1, and filter out the assets and systems associated with the business respectively;

[0071] Step S10-2: respectively obtaining the risk value (Ra) generated by the business-related assets and the system in step S9 and the asset value (Vc) generated in step S2;

[0072] Step S10-3: normalize the asset value (Vc) and calculate the business-related asset weight (Qa) of each asset;

[0073] Step S10-4: Multiply the business-related asset weight (Qa) corresponding to each asset or system by the system component and unit asset risk value (Ra) generated in step 9, then sum the multiplication results of all assets and systems, round off to 2 decimal places, and obtain the business risk value (Rb);

[0074] The normalization processing mentioned in step S10-3 refers to summing up the asset value (Vc) corresponding to each asset and system associated with the business, and then dividing the asset value (Vc) of each asset or system by the sum of the asset values ​​to obtain the business-related asset weight (Qa) corresponding to each asset or system. This ensures that the sum of all asset weights (Qa) associated with the business is equal to 1.

[0075] S11. Calculate the system asset risk value (R), the main steps are:

[0076] Step S11-1: Obtain the information data entered in step S1, and filter out the assets associated with the system and the data of the current system respectively;

[0077] Step S11-2: respectively obtaining the assets associated with the system and the risk value (Ra) generated by the current system in step 8 and the asset value (Vc) generated in step S2;

[0078] Step S11-3: normalize the asset value (Vc) and calculate the system-related asset weight (Qb) of each asset and the current system;

[0079] Step S11-4: Multiply the system-related asset weight (Qb) corresponding to each asset and the current system with the system component and unit asset risk value (Ra) generated in step S9 to obtain the multiplication result of each asset and the current system, and then sum the multiplication results of all assets and the current system, round off to 2 decimal places, and obtain the system asset risk value (R);

[0080] The normalization processing mentioned in step S11-3 refers to summing up the asset value (Vc) of each asset associated with the system and the asset value corresponding to the current system, and then dividing the asset value (Vc) of each asset or the current system by the sum of the asset values ​​to obtain the system-related asset weight (Qb) corresponding to each asset and the current system. This ensures that the sum of all asset weights (Qb) associated with the system is equal to 1.

[0081] S12. Generate a risk assessment conclusion based on the calculated business risk value (Rb) and system asset risk value (R). The present invention will automatically generate a corresponding risk assessment conclusion for each business and system.

[0082] The risk assessment conclusions are divided into five levels. When the risk value ranges from 4.5 to 5, the conclusion is very high; when the risk value ranges from 3.5 to 4.49, the conclusion is high; when the risk value ranges from 2.5 to 3.49, the conclusion is medium; when the risk value ranges from 1.5 to 2.49, the conclusion is low; when the risk value ranges from 1 to 1.49, the conclusion is very low.

[0083] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A security assessment method based on information security risk assessment, characterized in that: The following steps are included: S1. Enter business information data and system information, where the system information includes CIA values ​​and associated business names. After entering the system information, the user calculates the asset value of each system based on the CIA values, and establishes an association between the business and the system based on the business name associated with the system, and searches for the associated system in the business information table. S2. Enter asset information, where part of the asset information includes CIA values ​​and associated business names and associated system names. After entering the asset information, the user calculates the asset value of each asset based on the CIA values, and establishes an association relationship between the asset and the business based on the business name associated with the asset, and establishes an association relationship between the asset and the system based on the system name associated with the asset. S3. Create a risk assessment project for the filled systems and assets, and upload the vulnerability scan data in the risk assessment project; S4. Create corresponding verification records for systems and assets. The system and asset information filled in by the user includes the detection item guide. The user selects the system or asset for information security risk assessment and refers to the relevant standards. When the user creates verification records for these systems and assets, a blank verification record is automatically created based on the verification item content of the detection item guide corresponding to the system / asset for the user to fill in. S5. Enter the verification records and verification results. The user fills in the verification records and verification results of the system or asset in each verification item based on the actual situation; S6. Enter the detection problem summary table. The user assigns values ​​to each risk point in the detection problem summary table generated in step S5. The three fields are mainly assigned values, including the ease of vulnerability exploitation, the vulnerability impact, and the threat value. S7. Calculate the risk value of a single risk point. The main steps are: Step S7-1: Calculate the possibility of a security incident according to the ease of exploitation of the vulnerability of the risk point and the threat value, by taking the square root of the product of the two and rounding to zero decimal places; Step S7-2: Calculate the loss caused by the security incident according to the impact degree of the risk point and the asset value generated in step S1 or step S2, by taking the square root of the product of the two and rounding to zero decimal places; Step S7-3: Calculate the risk value of a single risk point using the results of step S7-1 and step S7-2. The calculation method is to take the square root of the product of the two and round off to retain 0 decimal places. S8. Integrate existing safety measures to recalculate risk values. The main steps are: Step S8-1: Review existing security measures for each risk point, mainly referring to two indicators: one is the ease of vulnerability being exploited, and the other is the impact. If the existing security measures do not reduce the security risk, the original risk value remains unchanged. If there is an indicator whose existing security measures reduce the security risk, the value of the indicator becomes half of the original value, rounded to 0 decimal places; Step S8-2: Based on the latest vulnerability exploitation difficulty and impact calculated in step S8-1, re-execute the operation of step 7 to calculate the latest risk value; S9. Calculate the risk value of system components and unit assets by adding up the risk values ​​of all verification items corresponding to the assets and dividing the sum by the total number of verification items to obtain the average value, rounding to zero decimal places; S10. Calculate the business risk value. The main steps are: Step 10-1: Obtain the business information data entered in step S1, and filter out the assets and systems associated with the business; Step 10-2: respectively obtaining the assets associated with the business and the risk value generated by the system in step S9 and the asset value generated in step S2; Step 10-3: Normalize the asset values ​​and calculate the business-related asset weights of each asset; Step 10-4: Multiply the business-related asset weight corresponding to each asset or system by the system component and unit asset risk value generated in step S9, then sum the multiplication results of all assets and systems, round off to 2 decimal places, and obtain the business risk value; S11. Calculate the system asset risk value. The main steps are: Step 11-1: Obtain the information data entered in step S1, and filter out the assets associated with the system and the data of the current system; Step 11-2: respectively obtaining the assets associated with the system and the risk value generated by the current system in step S8 and the asset value generated in step S2; Step 11-3: Normalize the asset value and calculate the system-related asset weight of each asset and the current system; Step 11-4: Multiply the system-related asset weight corresponding to each asset and the current system by the system component and unit asset risk value generated in step S9 to obtain the multiplication result of each asset and the current system, then sum the multiplication results of all assets and the current system, round off to 2 decimal places, and obtain the system asset risk value; S12. Generate risk assessment conclusions based on the calculated business risk values ​​and system asset risk values, and automatically generate corresponding risk assessment conclusions for each business and system.

2. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: The CIA values ​​assigned in step S1 and step S2 are the scores of the asset in terms of confidentiality, integrity, availability, business carrying capacity, and business importance. Each score has five levels, namely: very high - 5 points, high - 4 points, medium - 3 points, low - 2 points, and lowest - 1 point; The asset value is obtained by adding up the scores assigned by the CIA and finding the average, and rounding the result to 0 decimal places to obtain the asset value.

3. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: In step S4, relevant standards involved in the safety risk assessment object are pre-stored, and users are supported to upload and enter new standard file data. When filling in the inspection item instruction field, the user can select the relevant standard file.

4. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: In step S5, the verification results are divided into compliance and non-compliance. If the verification result of a certain verification item is non-compliance, it is considered to be a risk point; the verification items with non-compliance results are automatically screened out for each asset and system, and added to the detection problem summary table, as well as the risk points where vulnerabilities exist in the asset or the system in the vulnerability scanning data, which are also added to the detection problem summary table.

5. The security assessment method based on information security risk assessment according to claim 4 is characterized in that: In step S6, the data source of the threat assignment is the threat identification result table entered by the user. When the user performs risk assessment, the collected threat intelligence and information will be classified and a threat identification result table will be output, including the corresponding threat behavior and threat assignment; When the user assigns a threat value to a risk point, the threat behavior corresponding to the risk point is selected, and the threat value of the threat behavior is automatically associated with the risk point, thereby completing the assignment operation.

6. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: The risk value mentioned in step S7 and step S8 refers to the risk assessment score of a certain system or a certain asset under a certain verification item.

7. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: The normalization processing in step S10-3 refers to summing up the asset values ​​corresponding to each asset and system associated with the business, and then dividing the asset value of each asset or system by the sum of the asset values ​​to obtain the business-related asset weight corresponding to each asset or system, ensuring that the sum of all asset weights associated with the business is equal to 1.

8. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: The normalization processing in step S11-3 refers to summing up the asset value of each asset associated with the system and the asset value corresponding to the current system, and then dividing the asset value of each asset or the current system by the sum of the asset values ​​to obtain the system-related asset weight corresponding to each asset and the current system, ensuring that the sum of all asset weights associated with the system is equal to 1.

9. The security assessment method based on information security risk assessment according to claim 1 is characterized in that: The risk assessment conclusion is divided into five levels. When the risk value ranges from 4.5 to 5, the conclusion is very high; when the risk value ranges from 3.5 to 4.49, the conclusion is high; when the risk value ranges from 2.5 to 3.49, the conclusion is medium; when the risk value ranges from 1.5 to 2.49, the conclusion is low; when the risk value ranges from 1 to 1.49, the conclusion is very low.

Images