非金融支付机构信息安全风险评估模型研究

针对非金融支付机构信息安全管理相对薄弱这一现状,本文以信息安全管理国际标准ISO27001为理论基础,根据非金融支付机构的业务运作模式、信息化基础设施建设及运维模式的特点,通过分析资产、脆弱性、威胁以及风险等关键要素间的相互关系,采用定性和定量评估相结合的方式,从而形成一套较为完善的非金融支付机构信息安全风险评估模型,为人民银行进一步加强非金融支付机构技术监管,保障金融稳定提供科学的方法论支持。

Research on the Model of Risk Assessment for Information Safety of the Third Payment Institution

The situation of information safety of the third payment institution was relative weak. Based on the theory of international standard ISO 27001, this paper puts forward a set of relative perfect information security risk assessment model on the way of the combination of qualitative and quantitative evaluation, according to the characteristics of non-financial payment mechanism of business operation mode, information infrastructure construction and operation mode. Through analyzing the fragile relationship between key factors, threat and risk assets, all of which provide scientific methodology for further strengthening the supervision mechanism of the third party payment institution and securing Guangxi financial stability.