关键词: 可操作性关键威胁评估和脆弱性评估, 信息安全, 风险评估, 政务外网, 等级保护

Abstract: This paper introduces an information security risk assessment method based on OCTAVE, which consists of three phases and eight specific processes. Firstly, it created an asset-based threat outline, secondly it identified infrastructure vulnerabilities, at last, it produces a security strategy and project plan. Compared with the NIST method, this method highlights the advantages of the method autonomously and operability. Finally, the application of OCTAVE method in the risk assessment of e-government extranet system is described in detail. It creats asset-based threat profiles and developed security policies and link plans for infrastructure vulnerabilities. This includes the establishment of a reasonable safety management organization, strict implementation of management systems and background investigation requirements, and establishment of strict system protection measures.

Key words: OCTAVE, information security, risk assessment, e-government extranet system, classified protection