关键词: 业务流程, 信息安全风险控制, 线性规划方法, 控制成本

Abstract:

In order to effectively control the security risks of the business process in the information system, a risk control method based on work-flow (WRCM) was proposed. It includes two operations, the risk quantification and the risk control. In the risk quantification operation, the risk quantification parameters are defined and initialized. In the risk control operation, the minimum residual risk damage was used as object function to get a minimum risk damage deployment scheme based on linear programming method through the control effect maximization operation. Then, the minimum control cost was used as object function to get the minimum control cost deployment scheme through the control cost minimization operation. Experiments show that the WRCM has preferable risk control effect and lower control cost.

Key words: work-flow, information security risk control, linear programming method, control cost