A novel security risk assessment model for information system

Security defense against threats is very important to information system. A novel security risk assessment model is presented. In this model, an information system consists of a series of network nodes, which have three elements: assets, rights and vulnerabilities. To analyze the relevance between vulnerabilities, an algorithm for intrusion path discovery is proposed centralized on assets. By investigating the intrusion paths found, the system risk is quantitatively evaluated on vulnerabilities, nodes, assets, or system, which indicates the risk situation of the system. A simulation experiment and results verify availability and effectiveness of the model.