基于综合权衡分析的信息安全管理系统评估

Evaluation of Information Security Management System Based on Tradeoff Analysis

随着信息时代的到来,每个组织所拥有和需要的信息越来越多,构建信息安全管理系统日益受到各级组织的重视。采用综合权衡分析方法,研究信息安全管理系统的评估问题。构建了一个包括整体评估和系统优化两层含义的信息安全管理系统评估框架,框架完全符合评价、分析及优化的系统工程思想。提出了基于综合权衡方法的信息安全管理系统评估的一套方法集,方法集不仅实现了定性定量相结合的评估思路,而且实现了评估过程的可视化。研究一方面可以总结信息安全管理系统评估的相关理论和方法,另一方面可以有效地指导我国信息安全管理系统的建设工作。

Along with the advent of information era, each organization possesses and needs more and more information. They pay great attention to the construction of the Information Security Management System （ISMS）. This study applies the tradeoff analysis to evaluate the ISMS. It constructs an available framework for ISMS evaluation. This framework includes the holistic evaluation and the system optimization, and is consistent with the thought of system engineering. It presents an effective methodology set for ISMS evaluation. The methodology set is based on the tradeoff analysis, and combines the qualitative analysis with quantitative analysis, and realizes the visualization of optimization process. This study can summarize some interrelated theories and methodologies for ISMS evaluation on the one hand, and can help the construction of the ISMS of our country on the other hand.