The Study On Information Technology Risk Management System Of Petroleum Enterprises

The modern science and technology what is represented by information technology(IT)develops rapidly,it deeply affects and changes the development and operation of modern petroleum enterprises.The upstream sectors,taking "Digital oilfield" as the core,are carrying through centralized management of digital platform for the links such as petroleum extraction,processing,transmission and so on by using automatic data acquisition,automatic monitoring of production process,centralized data sharing,remote real-time monitoring and others.The midstream sectors monitor and control the entire process of petroleum storage,transportation and refining via business control systems and real-time communication system.The downstream sector,the sales company,which is based on ERP system is doing unified scheduling,storage and transportation and sale with network and intelligence for petroleum product.The informatization degree of petroleum enterprises improve continually,as the modern petroleum enterprise relies heavily on IT.Along with high integration of IT and petroleum business,and unceasing development and application of ITs such as cloud computing,big data and mobile internet and others,the petroleum enterprise's IT risk is increasing day by day.As a new subject for the petroleum enterprise,researching IT risk management has a certain theoretical and practical significance.In consideration of the status quo of petroleum enterprises' management of IT risks,this dissertation takes the IT risk management system of petroleum enterprise as research object;constructs new IT risk management systems for petroleum enterprises in the help of research results concerning risk management theories and in combination with IT risks in petroleum enterprises as well as realities and theories of IT risk management;with a method which combines the quantitative and qualitative analysis,this dissertation studies petroleum enterprises' identification,assessment and treatment of IT risks,as well as the IT risk early-warning method with a two-layer structure.Firstly,based on literature review,it concludes and demarcates the concept of IT risk and IT risk management system in petroleum enterprise,namely,IT risk of petroleum enterprises refers to business risk caused in their using,owning,operating,participating and applying IT,including adverse conditions caused by computer hardware,software and networking system.Besides,it expounds its connotation and extension and defines the main body and boundary of research.Secondly,it collects,arranges and analyzes information of IT construction,IT risk management and IT risk accidents in petroleum enterprise.Based on existing theories and practice of IT risk management of petroleum enterprises,it classifies the IT risks of petroleum enterprises into five categories:IT risk management risk,information security risk,IT service risk,business continuity risk and IT outsourcing risk;it summarizes the characteristics and manifestations of IT risks in petroleum enterprises;it also clarifies the status quo of IT risk management in petroleum enterprises;at present,the petroleum enterprise has had the basic framework of IT risk management,it has certain capacity to prevent IT risks,but the current situation of petroleum enterprise's IT risk management is still not optimistic;there are a lot of flaws and vulnerabilities,for example,the IT planning and construction of petroleum enterprise is not perfect,the IT risk management has large hidden danger,the current situation of IT risk management in self-controllable aspect is grim and so on.This dissertation analyzes the trigger coupling and evolution mechanism of typical IT risk events in petroleum enterprise,and discusses the revelation of typical IT risk events to set up IT risk management system for petroleum enterprise.Enterprises shall apply strict systemic management of procedure,and focus on identifying and evaluating IT risk management events,as well as early warning of IT risk events.Thirdly,based on necessity analysis,the dissertation,combining the arguments of system theory,constructs a petroleum enterprise IT risk management system,which consists of three dimensions-subject,hierarchy and process-as well as four interconnected subsystems-strategic objective,strategic support,process management and integration management.The IT risk management system of petroleum enterprise is a target system with three layered structure,which is consisted by strategic target of policy makers,risk control target of management layer and the real-time monitoring and early-warning target of IT risk from business layer.Each layer has its appropriate and effective method,constituting the method system of IT risk management system.This dissertation combines management system with the connotation of system,mechanism,legal system,analyzes the corresponding relationship between three systems and the functional layers of four subsystems;it clarifies that IT risk management system in petroleum enterprise is the comprehensive system based on three dimensions of system,mechanism and legal system.The most important method is IT risk's identification,assessment and treatment in IT risk management layers,as well as IT risk early warning for the management layer and business layer simultaneously.Fourthly,it qualitatively analyzes the difficulties in identification,assessment and treatment with IT risk in petroleum enterprise;on basis of the core subsystem of risk management,it systematically studies the identification,assessment and treatment method of IT risk in petroleum enterprise;it sets up the identification method of IT risk in petroleum enterprise based on the combination method of risk identification and the assessment method of IT risk in petroleum enterprise based on cloud model;in view of the different IT risk categories in petroleum enterprise,the treatment strategy of IT risk in petroleum enterprise is put forward.Corresponding methods,models and strategies have been applied through the actual case of Daqing Petrochemical Co.,through recognizing the most of IT risk in Daqing Petrochemical Co.,the feasibility and effectiveness of combination method of IT risk identification in petroleum enterprise are verified,and the risk assessment has obtained quantitative IT risk expectancy value of Daqing Petrochemical Co.,what is consistent with qualitative evaluation.It shows that the IT risk assessment method in petroleum enterprise which is based on cloud model is efficient and reliable.Fifthly,the outlier recognition theory and the neural network with optimization genetic algorithm are introduced to construct two warning models,which facing two aspects:the IT risk early-warning model in petroleum enterprise,what is based on outlier recognition theory,and the risk situation awareness early-warning model in petroleum enterprise,what is based on GA_BP neural network.The two models are in accordance with the two layered structure,IT risk early-warning model and IT risk situation awareness early-warning model.In Consistent with this two layered structure,The system architecture of IT risk early-warning platform in petroleum enterprise is divided into two layers,consists of two systems,one is "IT risk early-warning system",what is based on the IT risk early-warning model and used in risk monitoring and early-warning the IT environment of a petroleum enterprise,the other is "risk situation awareness system",what is based on the IT risk situation awareness early-warning model and used in monitoring and early-warning the IT risk of petroleum enterprise,the data between both can be interconnected.Taking Daqing Petrochemical Co.as the study case,it proves the results of GA BP is better,and can meet the needs of IT risk more effectively.