目前風(fēng)險(xiǎn)分析方法以定性分析為主。但是定性分析方法有很大的局限性：首先，定性的分析方法不是用數(shù)學(xué)或統(tǒng)計(jì)的工具將風(fēng)險(xiǎn)模型化，因此一次風(fēng)險(xiǎn)評(píng)估的成敗與執(zhí)行者的經(jīng)驗(yàn)有很大的關(guān)系[1]。其次，由于沒(méi)有對(duì)影響大小給出具體的定量度量，因此使得對(duì)控制措施進(jìn)行成本效益分析變得很困難。但是很多時(shí)候，做這種分析往往是必要的。本文
討論風(fēng)險(xiǎn)的定量測(cè)量VaR 法在信息安全風(fēng)險(xiǎn)評(píng)估中的應(yīng)用。
關(guān)鍵詞：信息安全，VaR 法，風(fēng)險(xiǎn)評(píng)估
Abstract： Risk analysis methods based on qualitative measures have some disadvantages. First, qualitative risk analysis methods do not use tools like mathematics and statistics to model the risk, the results of method is vastly depended on the ideas of people who conduct the risk analysis. Second, having not given the quantitative measures of impacts, it is difficult for controls to do cost-benefit analysis. And sometimes, that is very important. In this paper, we applied VaR methods in information security risk assessment.
Keywords ：Information Security, VaR, Risk Assessment