复杂信息系统风险评估框架与流程

Risk Assessment Framework and Process of Complex Information System

复杂信息系统(CIS)在系统风险管理和风险评估上因其结构复杂性而存在较大难度。为此,基于Zachman框架,提出一种CIS风险评估框架,并在GB/T 20984-2007信息安全技术-信息安全风险评估规范基础上,建立CIS的风险评估流程。依据风险管理层次与安全域划分原则对CIS进行架构分解,研究安全域内和域间的评估方法。在传统风险要素的基础上增加CIS互联关系的风险要素。引入互信息表征互联关系的关联度,利用层次分析法对风险权重进行评估。结合实例对CIS风险评估流程进行验证,结果表明,该流程可对CIS风险做出客观准确的评估。

Research on Complex Information Systems（ CIS） is a big difficulty on a system of risk management and risk assessment because of the complexity of the structure. Based on Enterprise Architecture（ EA） Zachman framew ork and GB / T 20984-2007 standard information security risk assessment norms,this paper presents a complex model of information system risk assessment framew ork and establishes a risk assessment process CIS. Based on risk management hierarchy and principle of security domain,it decomposes the architecture of CIS and studies assessment w ithin and betw een domains. On the basis of traditional risk factors,the paper increases interconnection risk factor as the specific factor to the CIS,it introduces correlation to characterize interconnection and AHP method. With examples of CIS risk assessment process is validated,results show that the process can make an objective and accurate assessment for CIS risk.