摘要
为保障关键信息系统的安全,明确系统内存在的安全隐患并采取风险控制措施,安全风险评估作为信息安全保障的重要环节,已经越来越受到各行业安全主管人员的重视。文中在广泛研究风险评估理论和实践基础上,设计实现了一个信息安全风险评估管理系统,该系统基于项目管理的形式,实现了风险评估的完整流程,包括问卷调查、资产识别、威胁识别、脆弱性识别、风险识别、统计与分析、风险控制建议等环节。在实际应用中取得了良好的效果。
As a key link of information security assurance, information security risk assessment has attracted much attention from the managers of various fields. A risk assessment management system is designed and implemented based on wide study of international ＆ domestic risk assessment theories and practice. This system implements a complete flow of risk assessment under project management, including questionnaire investigation, the recognition of information assets, threats, vulnerabilities and risks, etc.
出处
《信息安全与通信保密》
2009年第10期102-104,共3页
Information Security and Communications Privacy
关键词
信息安全
风险评估
管理系统
information security
risk assessment
management system
