SECURITY KNOWLEDGE

1. why we need information systems security risk assessment It is clear that when we are very happy to accept and use a new technology to assist us in our security work, this technology must have a reason to drive us to use it. This reason is the main function of this technology in a certain security aspect, and we only use it for these main functions. For information system security risk assessment, we have roughly understood his definition at the beginning of this article, from its definition, we can understand that risk assessment can be in the life cycle of information systems.

Fire risk assessment and the related concepts involved in the process of fire risk assessment are: fire risk assessment: the process of evaluating the fire safety performance under the combined effect of the target object, the vulnerability of the protected object, the effectiveness of the risk control measures, the severity of the risk consequences and the above factors. Acceptable risk: The level of risk acceptable to the organization or the public under the current conditions of technological, economic and social development. Fire safety: In the event of a fire, possible damage to personal safety, property and the environment can be controlled below an acceptable risk. Fire

There are several key issues to consider during the risk assessment process. First, what is the object (or asset) to be protected? What is its direct and indirect value? What are the potential threats to assets? What's the problem with the threat? How likely is the threat? Third, what weaknesses exist in the asset that could be exploited by the threat? How easy is it to use? Fourth, once a threat event occurs, what kind of loss or negative impact will the organization suffer? Finally, what security measures should the organization take to minimize the loss of risk? solve the above problems

1. Risk Factor Analysis Risk Factor Analysis is a risk assessment method that evaluates and analyzes the factors that may lead to the occurrence of risk, so as to determine the probability of risk occurrence. The general idea is: investigate the source of risk, identify the risk conversion conditions, determine whether the conversion conditions are available, estimate the consequences of risk occurrence, risk evaluation. 2. Fuzzy Comprehensive Evaluation Method 3. Internal Control Evaluation Method Internal Control Evaluation Method refers to a method of determining audit risk by evaluating the internal control structure of the audited unit. Since the internal control structure is directly related to control risk, this approach is mainly used to control wind.