Library and Information Service >
Study on the Risk Assessment Method and Model of Digital Libraries’ Information Security
Received date: 2013-12-27
Online published: 2014-01-20
Based on a comparison and an analysis of various risk assessment methods, this paper proposes that a digital library should take a semi-quantitative analysis as the information security risk assessment method, which integrates both qualitative and quantitative methods. In terms of risk assessment model, the paper introduces a few assessment models from ISO 27000, GB/T 20984 and other frequently used in practical work. Comparing these models and their weaknesses and strengths, the paper then probes into their applicability in the information security management of digital libraries. The practical tests of these risk assessment methods in real work and theoretical analysis proves that the best risk assessment model for information security risk assessment of digital libraries is the multiplication model from the GB/T 20984, a national standard of China.
Huang Shuiqing , Ren Ni . Study on the Risk Assessment Method and Model of Digital Libraries’ Information Security[J]. Library and Information Service, 2014 , 58(02) : 14 -20 . DOI: 10.13266/j.issn.0252-3116.2014.02.002
[1] ISO/IEC Guide 73:2002.Risk management — Vocabulary — Guidelines for use in standards[S]. Geneva: International Organization for Standardization, 2002:8-9.
[2] 冯登国,张阳, 张玉清.信息安全风险评估综述[J].通信学报,2004(7):10-18.
[3] 昊天.国际标准化组织有关信息安全标准的活动[J].信息网络安全,2005(3):35-36.
[4] 王伟,李春平,李建彬.信息系统风险评估方法的研究[J].计算机工程与设计,2007(7):3473-3475.
[5] 任帅,慕德俊,张弢,等.信息安全风险评估方法研究[J].信息安全与通信保密,2009(2):54-56.
[6] 王奕,费洪晓,蒋蘋.FAHP方法在信息安全风险评估中的研究[J].计算机工程与科学,2006(9):4-6,12.
[7] 赵冬梅,刘海峰,刘晨光.基于BP神经网络的信息安全风险评估[J].计算机工程与科学,2007(1):139-141.
[8] 付钰,吴晓平,严承华.基于贝叶斯网络的信息安全风险评估方法[J].武汉大学学报(理学版),2006(5):631-634.
[9] 吴叶科,宋如顺,陈波.基于博弈论的综合赋权法的信息安全风险评估[J].计算机工程与科学,2011(5):9-13.
[10] 高阳,罗军舟.基于灰色关联决策算法的信息安全风险评估方法[J].东南大学学报( 自然科学版),2009(12):225-229.
[11] 李绍中.支持向量机的智能信息安全风险评估模型[J].计算机应用与软件,2013(8):330-333.
[12] 孙强.定量的信息安全风险评估计算模型的研究[J].计算机应用与软件,2012(9):285-288.
[13] ISO/IEC 27005:2011. Information technology — Security techniques — Information security risk management[S]. Geneva: International Organization for Standardization, 2011:52-55.
[14] GB/T 20984-2007.信息安全技术—信息安全风险评估规范[S].北京:中华人民共和国国家质量监督检验检疫总局,中国国家标准化管理委员会,2007:18-23.
[15] 张弢,慕德俊,任帅,等.一种基于风险矩阵法的信息安全风险评估模型[J].计算机工程与科学,2010(5):93-95.
[16] ISO/IEC 27002:2005. Information technology — Security techniques — Code of practice for information security management[S]. Geneva: International Organization for Standardization, 2005:1,3.
/
| 〈 |
|
〉 |
