Research on the calculation method of information security risk assessment considering human reliability

摘要

Information security risk assessment is the premise and basis for ensuring the security of information systems. Current research on risk assessment focuses on the calculation methods and assessment models of the risk value. Also, lots of automatic assessment tools have been applied to risk assessment. However, these methods didn't take human errors in risk assessment work into consideration, thus couldn't solve the problem brought by the influence of human errors on final assessment results. As a result, this paper introduces the Technique for Human Error Rate Prediction (THERP) which is a mature technique in human reliability analysis into the process of information security risk assessment. Combined with current analysis techniques of human errors in computer science and aiming at the calculation process of the risk value of important assets in information security risk assessment, research on the calculation method of risk value considering human reliability is carried out in this paper. The calculation method of human error rates in the entire process of risk value calculation is proposed. An example is provided to verify the method proposed in this paper.