关键词: 信息系统, 风险评估, 威胁分析, 定量分析, 灵敏度分析

Abstract: In the field of information security，risk assessment is the core of the risk management and control，also is the foundation and premises that builds up the safe system of the information system.This paper analyses the standards and process of information security risk assessment，and proposes a quantitative security risk method ISSREM（Information System Security Risk Evaluation Method），based on threat analysis.ISSREM has features such as easily operative，independent，practical and the evaluation results comparable.And the sensitivity analysis of threaten frequency is presented，which makes the evaluation results more objective.This paper gives the calculation model of the method and the main procedures of risk evaluation using the method.Finally，with examples to analyze the quantitative assessment method，this paper validates the rationality and effectiveness of the method.

Key words: information system, risk assessment, threat analysis, quantitative analysis, sensitivity analysis