Abstract: Being safe and economical is the main foundation when enterprises make the decision on information security defense, so that enterprises need to trade off optional allocation of defense resources among many different information nodes in the network information system. This paper firstly establishes a decision model of security defense without resource constraints in order to study how enterprise optimizes the allocation of its defense resources, and the result obtains the defense threshold and relative economical defense level of different nodes. Furthermore, the condition that security resources are limited is combined into the basic model. Through analyzing the impact of factors such as the defensive value of different information nodes, the expected loss, attack probability and so on, we draw conclusions about the priority of different nodes, the amount of resources invested in the defense of different nodes.

Key words: information system, resources allocation, constrains theory, information security

摘要： 安全经济性是企业信息安全防御决策的重要依据,在网络信息系统中企业需要权衡如何在众多不同信息资源节点间实施防御资源的合理分配。本文首先构建了无安全资源约束下的安全防御决策模型,研究企业在信息安全防御中如何来优化分配其防御资源,得出不同信息节点存在防御阀值以及各节点的相对经济防御水平值;在此模型基础上增加了安全防御资源约束条件,分析不同信息资源节点的防御价值、损失预期、攻击概率等因素对决策的影响,得出企业在不同节点上的防御优先级以及防御过程中投入资源量等相关结论。

关键词: 信息系统, 资源分配, 约束理论, 信息安全