网络信息安全的本质是安全风险管理,而风险评估是风险管理的基础。信息时代,信息化程度日益提高,同样信息网络安全问题且异常严重,频繁发生的安全事件,使许多系统遭受巨大的损失。为此许多组织花了较大的投资、付出许多心血来建设网络信息安全,但均收效甚微,安全是相对的、动态 The essence of network information security is security risk management, and risk assessment is the foundation of risk management. In the information age, the degree of informatization is increasing day by day. The same information network security problem is extremely serious. Frequent security incidents have caused huge losses to many systems. To this end, many organizations have invested large amounts of money and devoted much effort to building network information security, but with little success and safety is relative. The dynamic