Information security risk assessment system and method

Abstract

The information security risk assessment system disclosed by the invention comprises an asset information acquisition module, a risk factor identification module, a risk degree analysis module, a riskgrade evaluation module and a risk control module. The risk factor identification module is used for identifying risk factors. The risk degree analysis module is used for synthesizing the analysis results according to the existing security measures analysis information, threat source analysis information, threat behavior analysis information, vulnerability analysis information, asset value analysis information and impact degree analysis information. The risk grade evaluation module is used for obtaining the risk evaluation report according to the comprehensive evaluation risk grade of the risk evaluation algorithm library. The risk control module is used to make corresponding risk control measures according to the risk assessment report. By combining the frequency of threat sources, the severity of vulnerability utilization and asset value to calculate the risk rating, comprehensive assessment, assessment of a wider range, can be based on the assessment data to make corresponding riskcontrol measures.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to an information security risk assessment system and method. Background technique [0002] The research on information system security risk assessment in foreign countries has a history of more than 20 years. In the 1970s and 1980s, IT developed countries such as the United States and Canada established national certification bodies and risk assessment certification systems, responsible for researching and developing relevant assessment standards. , Evaluate certification methods and assessment technologies, and conduct information security assessment and certification based on assessment standards. At present, the standard systems, technical systems, organizational structures, and business systems related to information system risk assessment in these countries are quite mature. From the point of view of relevant countries that have established information sec...

AI Technical Summary

Problems solved by technology

The current information system risk assessment is mainly carried out through the threat assessment method, that is, according to the security incidents generated by the vulnerability warning information and the virus warning information, the threat screening of the security incidents, the identification of the risk level and the correlation of the corresponding information asset information are generated. Risk assessment data, this risk assessment method has a single assessment item, the scope of assessment is small, the assessment ignores potential threats, and corresponding risk control cannot be performed based on the assessment data

Images