信息安全风险评估工具及其应用分析

信息安全风险评估是信息安全保障工作中的一种科学的方法。要准确地评价信息系统中的薄弱点和风险状况,除依靠评估人员的技能外,评估工具也是一个重要的环节。文中对风险评估中常用的工具进行分析,分别介绍了主动型、被动型和管理型风险评估工具在风险评估工作中的工作机制与作用,并通过实例展示如何利用评估工具引导评估人员得到相对客观的结果。

Tools for and Their Applications in Information Security Risk Assessment

Information security risk assessment is a scientific method for insurance of information security. In order to exactly evaluate the vulnerability and risk, this insurance job depends on the skill of the evaluator, furthermore, the risk-assessment tools also play on important role. This paper presents the techniques and functions of the commonly-used tools, including the passive tools, active tools and administrative tools. Meanwhile, through many cases, the authors show how to guide the evaluator to acquire...