信息系统风险的组合评估方法

The Combination Evaluation Method of Information System Risk

1 引言 随着我国信息化的进程,信息安全问题也日渐突出.如何有效防止信息系统灾难性事件的发生,降低风险,已是我们所面临的重大课题.以往国外针对信息安全采取的是风险消除方法,传统的'可信计算机安全评价准则(TCSEC)'以及国际标准'信息技术安全评价公共准则(CC)'(ISO/IEC 154081998年通过)都是基于风险消除制定的[1].

Based on process control SSE-CMM model, by using risk analysis on character of information system, we give the method of applying combination analysis to the information system's risk. To a certain extent, this method overcomes the unilateral and randomicity of the traditional method and improves the accuracy of the risk analysis.