Abstract:

To make sure the assessment accuracy, an efficient algorithm with qualitative analysis and quantify calculate is described. To collect the data, the algorithm chooses the operationally critical threat, asset and vulnerability evaluation (O
CTAVE) method, defining the assets which need to be assessed, evaluating the administrant and technical vulnerabilities. To calculate the risk, grey theory is chosen, and triangular whiten weight function is used to compute the membership degrees, the risk level is then determined. This valuable method can be used in practical operations of information security risk assessment.

Key words: risk evaluation, grey system, normalization method