Information Security Risk Assessment In The Composite Model Of Asset Recognition Research

With the development and application of information technology, the security issues of information system have become a social matter relating to economic. Commercial banks are run depending deeply on information system and net work. Due to the feature of commercial banks, once security incidents happen, the loss will be huge. Risk assessment is a good way to identify and solve problems in time. Information security risk assessment can help the user of information system to identify potential crisis, so that we can take measures in time to reduce risk to controllable level. Asset identification is the basis of the overall risk assessment. At present, there is no detailed unified standard but some guiding norms in this field. And risk assessment is complex system engineering involving different disciplines, so when the work begin we should not only consider the computer system, but also the business demands. This paper is under the background of commercial banks, made thorough introduction of information security’s business risk and technical risk respectively, and gave a comprehensive analysis of the causes of risk. Then the paper proposed a model to solve the problem of asset identification in commercial bank information security risk assessment, using gray statistics to draw reliable results of the asset information security attributes, and get the target weights with the AHP method. This model is applied to identify the asset of a commercial bank’s information system. The results show that asset identification based on gray statistics overcomes the problem of quantifying the evaluation metrics difficulty and AHP method can get the weights objectively.