在如今的商业时代,信息对于企业是至关重要的。信息为企业创造价值的同时,

面临着信息安全的隐患。信息作为组织的重要资产,必须加以妥善的保护。国际、国

内的信息安全理论研究是近年来迅速发展和兴起的研究方向,也发布了一系列的信息

安全标准。B公司是一家跨国性大型建筑公司的上海分公司。信息安全关系到B公司

的设计欧亿·体育（中国）有限公司、专利技术、投标合同等商业机密,也关系到B公司的客户的重要机密信

息。因此,对公司的信息资产进行全面的风险评估和风险控制,建立起信息安全管理

体系,是B公司的迫切需求。

本文以B公司为研究对象,主要研究了基于IS027000信息安全管理体系的风险评

估和控制。论文首先对B公司的信息安全现状进行了深入的研究和剖析,找出确定风

险评估的范围。而后论文以IS027000的相关理论为指导思想,采用规范的信息安全管

理的评估流程,对评估范围内的B公司资产、威胁和薄弱点进行了风险评估,并运用

计算公式进行了风险值的计算。然后,论文再根据风险评估报告,使用风险控制的相

关理论为原则,为B公司提出了风险控制的具体方案建议。本文的研究成果可为同类

企业的信息安全风险评估和控制提供借鉴。

关键词:信息安全;风险评估;风险控制;信息资产;信息安全管理体系

第II页
华东理工大学硕士学位论文

A Research on Risk Evaluation and Control for B Corp. Based on

IS027000 Information Security Management System

ABSTRACT

Information is the key element to the successful business today. Information brings value

to the organization and profits to stakeholders, as well as some hidden dangers. As an

important part of organization's assets, information should be fully protected. It has become

the researcher's focus,how information can be well protected. Therefore,series of

information security management system has been published. B Corp. is the Shanghai Branch

of a global construction & engineering company. Information security relates to not only B

corp.'s designing, patent,contracts, but also clients' classified information. Thus,it is an

urgent requirement for B corp. to evaluate and control information security risks,and then

setting up information security management system.

The study researches the risk evaluating and risk controlling for B corp., basing on

IS027000. From the analysis of B corp.'s background, the risk control scope had been

defined. By the risk evaluating procedure of IS027000,B corp.'s information assets,threats,

vulnerabilities were identified. By the risk calculation formula,the study gave the risk

evaluation report. And according to the report and IS027000 requirements, mitigation plans

were drafted and advised. The study would be a reference of risk evaluation for other

organizations in information security.

Keywords: Information Security; Threat; Information Asset; Information Security

Management System