关键词: 信息安全, 风险评估, 威胁, 脆弱性

Abstract: Risk assessment has become an important part of information security management process. The method for risk assessment impacts the veracity and objectivity of the results, and also impacts the overall information security capacity of the organization. At present, many assessment methods only analyze threats and vulnerabilities of single asset, and the means to acquire the risk is questionnaires or matrix. They don’t provide systematic and objective risk value based on objects. This paper present a method of risk assessment based on combined objects, which adopts qualitative and quantitative means. This method resolves those problems and provides reasonable formula for computing the risk value.

Key words: information security, risk assessment, threat, vulnerability