城市通卡系统风险评估和改进.pdf

摘要 摘要 随着计算机技术、通信技术以及互联网技术的飞速发展，社会信息化进程逐 步加快。为满足新的全球范围内的数字化生存与竞争环境下，各国都将城市通卡 建设列入了工作日程，建立城市通卡信息安全保障体系已成为目前城市通卡安全 建设的首要任务。风险评估作为信息安全管理的重要内容，在信息安全管理体系 建设的各个阶段发挥着重要的作用。风险评估是一个综合评价过程，建立简化有 效的评估模型是顺利完成风险评估的基础。 本文通过分析国际、国内的先进的安全模型和风险评估方法，找出适合于城 市通卡系统的风险评估方法和途径，立足城市通卡系统特点，对城市通卡系统进 行层次化分解，将系统中涉及的各种风险因素进行抽象化地描述。建立了一个基 于OCTAVE 的城市通卡系统风险评估模型。依据城市通卡系统中资产价值，威胁 性、脆弱点和已有防范措施四者之间的关系，选取恰当的风险计算方法，计算出 城市通卡系统风险评估数值。 最后，将本文研究出的风险评估模型应用于城市通卡系统，得出城市通卡系 统的系统风险等级，并根据评估结果提出相应的风险改进策略。 关键词： 城市通卡系统 风险评估 信息系统安全 OCTAVE Abstract Abstract With computer technology, communication technology and the rapid development of Internet technology, social information process is picking up speed. To meet the new global digital existence and the competitive environment, city card will be included in the construction schedule of each country. Establishment of city card information security system has now become the important task of todays city card security building. The risk assessment as an important part of information security management plays an important role in various stages of information security management system construction. Risk assessment is a comprehensive evaluation process, and the establishment of streamlined and effective assessment of the risk assessment model is the basis for successful completion. Through the analysis of international and domestic advanced security model and risk assessment methods, we find suitable risk assessment methods and means for city card information system. Based on the characteristics of city cards system, we make hierarchical decomposition of the system, and finally get an abstract description of the various risk factors of th