关键词: Web信息系统, 安全评估, 风险评估, 模糊综合评价法

Abstract:

An increasing numbers of web information systems are deployed on the Internet to provide service, however, the web information system is facing various security threats, from physical security on bottom layer to communications and operations management, system security, application security and data security. The article gave out classifications of security threats faced by type of threats in web applications and set up grade for each threat according to its extent of danger, probability of occurrence and remediation. The article also uses fuzzy comprehensive evaluation to build a security analysis model aiming at constructing common analysis framework for web information system security assessment.

Key words: web information system, security assessment, risk assessment, fuzzy comprehensive evaluation