Abstract: A method based-on mission model for quantitative risk assessment is presented. It combines the information from manage level and technology level. Compared with traditional quantitative risk assessment methods, this model takes organizational mission target as core. It avoids the subjective bias, excluding negative influence of a great deal of irrelevant assets, vulnerabilities and threats. The method using key states to establish the relationship of assessment factors reduces misguidance of irrelevant vulnerabilities and threats. It makes the assessment results closer to objective reality.

Key words: risk assessment, quantitative, mission model

摘要： 将管理层面的评估与技术层面的评估相结合，提出了一种基于任务模型的风险量化评估方法。与传统的风险评估量化方法相比，该模型以组织的任务目标为核心，避免主观偏见，排除与任务无关的资产、弱点、威胁的影响。提出的基于关键状态建立评估要素之间关联关系的方法，减小了无关联威胁及弱点对评估结果的误导，更贴近客观现实.

关键词: 风险评估, 量化, 任务树