Available risk spread evaluating method

Abstract

The invention provides an available risk spread evaluating method which comprises the following steps: setting a dependency between network elements, a dependency between services and the network elements and a dependency between the services; dividing business network topology into at least two independent network element depending subtrees; periodically testing physical equipment contained in each network element node and the availability of each service arranged on the physical equipment on the network element depending subtrees; calculating the availability losing values of the physical equipment and the services, and then calculating corresponding availability risk levels, and the availability losses and the availability risk levels of the network element nodes according to a risk level mapping relation table predetermined by a user; calculating the spread of the availability losses of the network element nodes in the network element depending subtrees and all service sets dependent on the network elements; and updating an availability risk situation map of the total network. The method enhances the objectivity of calculation as well as the accuracy and reliability of risk evaluation.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a usability risk diffusion assessment method. Background technique [0002] In the information world, security issues are most likely to produce a "butterfly effect". Even a very robust information system can lead to major security disasters due to the exploitation of a small security weakness that is not taken seriously. Therefore, from the perspective of information security, it is necessary to doubt everything, and to be objective in doubting everything, there must be reliable risk measurement and assessment support. At the same time, only consistent risk measurement can achieve consistent risk assessment, thereby improving the credibility of risk assessment. [0003] There are two broad categories of risk assessment: qualitative and quantitative. Qualitative evaluation relies on evaluators' knowledge, experience, historical lessons, policy trends, and special examples to m...

AI Technical Summary

Problems solved by technology

Therefore, in the use of current information security risk assessment, it is impossible to compare the pros and cons of the two assessment products. At the same time, the risk assessment results of one enterprise are of little reference to another similar enterprise.

This has led to the following defects: 1) When users receive risk assessment products, they lack reference standards; 2) Manufacturers who develop risk assessment products cannot effectively apply the risk results obtained from one customer to another customer scenario middle

Similarly, when one of the active-standby hot-standby dual switches is restarted, from the node asset view, the event can only be evaluated as a "low-level risk notification event", because the business will not be interrupted, and it will be successfully started automatically; but , if a host is only attached to the restarted switch, then the event is the "highest risk service unavailability event" for the service assets on the host

Images