基于界壳综合实力的企业信息系统安全评价研究

Research on the Security Evaluation of Enterprise Information System Based on the Comprehensive Strength of Boundaries

为方便宏观了解各行业、规模、地区的企业信息系统安全水平,基于界壳论,提出界壳综合实力概念,建立企业信息系统安全评价模型。首先,根据企业信息系统防护阶段构建三层界壳防护体系,即预防信息受损外层界壳、抵抗内外部攻击中间层界壳、系统更新与维护内层界壳。其次,利用主成分分析和界壳综合实力,确定各评价指标权重。最后,运用模糊综合评判法构建多维度企业信息系统安全评价模型。结果表明,企业属性为第三产业、大规模、华东时,信息安全系统界壳综合实力最强,各层系统界壳防护实力在同级比较时同样最强,即企业信息系统界壳综合实力最强,各层界壳防护能力同样较为突出。算例结果符合实际情况,说明了模型的有效性。

In order to facilittate a macro understanding of the security level of enterprise information systems in various industries,scales and regions,based on the theory of periphery,the concept of comprehensive strength of periphery is proposed,and the enterprise information system security evaluation model is established.Firstly,according to the protection stage of enterprise information system,a three-layer peripheries protection system is constructed,that is,the outer periphery prevent information damage,intermediate periphery resist internal and external attacks,system renewal and maintenance of inner periphery.Secondly,the weights of each evaluation index are determined by using principal component analysis and comprehensive strength of periphery.Finally,a multi-dimensional enterprise information system security evaluation model is constructed by using the fuzzy comprehensive evaluation method.The result shows that when the enterprise attributes are tertiary industry,large-scale and east China,the comprehensive strength of information security system periphery is the strongest,and the protection strength of each layer system periphery is the strongest when compared at the same level,that is,the comprehensive strength of enterprise information system periphery is strongest,the protection ability of each layer periphery is also more prominent.The results of the example are in line with the actual situation,which shows the validity of the model.