目录
1. 概述 ........................................................................................................................................................5
1.1 项目背景 ...........................................................................................................................................................5
1.2 评估依据 ...........................................................................................................................................................5
1.3 评估范围 ...........................................................................................................................................................6
1.4 评估结论 ...........................................................................................................................................................6
2. 评估对象................................................................................................................................................8
3. 评估方法................................................................................................................................................9
3.1 风险评估模型 ..................................................................................................................................................9
3.2 风险计算模型................................................................................................................................................10
3.3 风险评估手段................................................................................................................................................11
3.3.1 顾问访谈.........................................................................................................................................11
3.3.2 人工审计.........................................................................................................................................13
3.3.3 工具扫描.........................................................................................................................................13
3.3.4 基线核查.........................................................................................................................................14
3.3.5 渗透测试.........................................................................................................................................14
3.4 风险评估过程................................................................................................................................................14
4. 风险识别 .............................................................................................................................................16
4.1 资产识别.........................................................................................................................................................16
4.1.1 资产识别概述................................................................................................................................16
4.1.2 资产识别方法................................................................................................................................16
4.1.3 资产识别结果................................................................................................................................17
4.2 威胁识别.........................................................................................................................................................17
4.2.1 威胁识别概述................................................................................................................................17
4.2.2 威胁识别方法................................................................................................................................17
4.2.3 威胁识别结果................................................................................................................................18
4.3 脆弱性识别 ....................................................................................................................................................19
4.3.1 脆弱性识别概述 ...........................................................................................................................19
4.3.2 脆弱性识别方法 ...........................................................................................................................19
4.3.3 脆弱性识别结果 ...........................................................................................................................19
4.4 已有安全措施识别.......................................................................................................................................20
4.4.1 技术层面.........................................................................................................................................20
4.4.2 管理层面.........................................................................................................................................21
5. 风险分析及评价 .................................................................................................................................21
5.1 风险分析方法................................................................................................................................................21
5.1.1 风险计算方法................................................................................................................................21
5.1.2 风险等级划分................................................................................................................................22
