关键词: 信息安全, 风险评估, 优劣解距离法, 灰色关联分析, 等级保护

Abstract: Information security risk assessment is very important in information security assurance. On the basis of information security standards, a risk assessment index can be made by analyzing assetthreatvulnerability factors. A feasible method is to refer to Baseline for Classified Protection of Cybersecurity version 2.0. A risk assessment method is proposed based on TOPSIS and GRA, using entropy weight. By case analysis, the entropy weight method reduces the subjective factor to some degree by setting the weights of the indicators according to the information entropy. The method based on TOPSIS and GRA takes into account both overall and internal factors and integrates multiple risk indicators into a single score, which facilitates the ranking and selection of information security risks.

Key words: information security, risk assessment, technique for order preference by similarity to ideal solution(TOPSIS), grey relational analysis(GRA), level protection