结合OCTAVE和灰色系统的信息安全风险评估方法

Algorithm of Information Security Risk Evaluation Based on OCTAVE and Grey System

为提高评估准确性,提出一种定性和定量结合的评估算法.在数据收集阶段采用可操作的关键威胁、资产、弱点评估(OCTAVE)方法,从企业中不同阶层成员的视角出发,定义需要评估的资产范围,并进行管理脆弱性与技术脆弱性评估.在定量计算部分,利用灰色系统理论,在对指标进行归一化处理后,利用三角白化权函数计算其隶属度,从而确定风险等级.实验结果表明,本文方法可有效提高信息安全风险评估的准确性,并具较好的实用推广价值.

To make sure the assessment accuracy,an efficient algorithm with qualitative analysis and quantify calculate is described.To collect the data,the algorithm chooses the operationally critical threat,asset and vulnerability evaluation（OCTAVE） method,defining the assets which need to be assessed,evaluating the administrant and technical vulnerabilities.To calculate the risk,grey theory is chosen,and triangular whiten weight function is used to compute the membership degrees,the risk level is then determined. This valuable method can be used in practical operations of information security risk assessment.