A Semi-quantitative Information Security Risk Assessment Model
Gui Ruo-bai · Information Security and Communications Privacy · 2009
To calculate the risk value in risk assessment, a model for information security risk assessment is proposed in this paper, which takes risk management as the core. The author specifically analyzes the key factors of the model, such as asset, vulnerability, threat, and deduces the calculation formula for risk value in accordance with the increase or decrease of the risk. Because the assessment result depends heavily on assessor's experience, the specific amount of risk value may not reflect the risk status comprehensively and accurately. Thus, the author proposes a semi-quantitative risk matrix, and with risk value level in matrix points out the risk seriousness of information asset.