目前風(fēng)險分析方法以定性分析為主。但是定性分析方法有很大的局限性：首先，定性的分析方法不是用數(shù)學(xué)或統(tǒng)計的工具將風(fēng)險模型化，因此一次風(fēng)險評估的成敗與執(zhí)行者的經(jīng)驗(yàn)有很大的關(guān)系[1]。其次，由于沒有對影響大小給出具體的定量度量，因此使得對控制措施進(jìn)行成本效益分析變得很困難。但是很多時候，做這種分析往往是必要的。本文
討論風(fēng)險的定量測量VaR 法在信息安全風(fēng)險評估中的應(yīng)用。
關(guān)鍵詞：信息安全，VaR 法，風(fēng)險評估
Abstract： Risk analysis methods based on qualitative measures have some disadvantages. First, qualitative risk analysis methods do not use tools like mathematics and statistics to model the risk, the results of method is vastly depended on the ideas of people who conduct the risk analysis. Second, having not given the quantitative measures of impacts, it is difficult for controls to do cost-benefit analysis. And sometimes, that is very important. In this paper, we applied VaR methods in information security risk assessment.
Keywords ：Information Security, VaR, Risk Assessment