一个威胁中心的信息安全风险评估模型

A Threat-centric Model for Information Security Risk Assessment

信息安全风险评估通过对资产、弱点、控制措施和威胁4个风险要素的识别与评估的综合获取被评估系统的风险值或风险级别,这4个风险要素之间存在复杂的关系,给风险评估的实施带来困难。依据最新的国际、国内风险评估标准,提出一个基本的3层评估体系结构和以威胁为中心的风险评估模型,将其他风险要素的评估结果统一到威胁风险评估中,清晰呈现了4个风险要素之间的关系,并适合于定性、定量或综合评估方法的实现。另外,3层体系结构也能用于实现不同细节层次上的风险评估的迭代循环。最后给出了模糊理论评价法在此模型中的具体实现。

In information security risk assessment, risk value or level of information system is evaluated by integrating results of identification and assessment for four risk factors-assets, vulnerabilities, control measures and threats, and complex relationships between the four risk factors lead to difficulties in the implementation of risk assessment. Based on the latest domestic and international risk assessment standards, a basic there-tier architecture and threat-centric risk assessment model are proposed. In the model, assessment resuits of the other risk factors are integrated into process of threat risk assessment, relationships between the four risk factors are clearly displayed, and the qualitative, quantitative or comprehensive assessment methods are also easy to be implemented. In addition, the there-tier architecture can be used to carry out the iterative cycle of risk assessment on different levels of detail. As an example, implementation of the fuzzy evaluation method is discussed in the model.