Information security audit system and method thereof

Abstract

The invention discloses an information security audit system and a method thereof. The information security audit method is applied to the information security audit system. The information security audit method comprises the steps outlined below. A normalized weighting of each of a plurality of members of an organization is computed according to a level and at least one feature of each of the members. A plurality of risk evaluation values corresponding to a plurality of audit items are computed and a normalized risk evaluation value of each of the members is further computed according to the risk evaluation values and the normalized weighting. A relation of the normalized risk evaluation value and a plurality of threshold value intervals are determined to dynamically adjust an audit period and / or a number of the audit items according to the relation.

Description

technical field [0001] The present invention relates to an information security audit technology, and in particular to an information security audit control system and method. Background technique [0002] Today, with the increasingly developed network and computer technology, a large amount of information can be processed and stored through computer devices, and can also be exchanged and transmitted quickly through the network. Although the use of networks and computers can speed up the processing and control of information and bring a lot of convenience, the vulnerabilities of networks and computers often become the target of hacker attacks. After being attacked by hackers, the confidential information of companies or public agencies may be leaked. Therefore, the importance of information security is self-evident. [0003] In the control process of information security, it is often assessed for a single weakness or an important asset, and it is impossible to provide an o...

AI Technical Summary

Problems solved by technology

[0003] In the control process of information security, it is often assessed for a single weakness or important asset, and it is impossible to provide an overall information security risk assessment for the organization or enterprise

In addition, information security risk assessment is mostly carried out in a fixed-cycle manpower manner. In the case of more and more information security threats and continuous occurrences, it will not be able to effectively control and control, thereby increasing the probability of information security incidents.

Images