ISO27001相关术语
信息安全
Preservation of confidentiality,integrity and availability of information.
保持信息的保密性､完整性和可用性｡
¨[ISO/IEC17799:2005]
Preservation of confidentiality,integrity and availability of information;inaddition,other properties,such as authenticity,accountability,non-repudiation and reliability canals obeinvolved.
保持信息的保密性､完整性和可用性;另外,还包括真实性､可核查性､抗抵赖和可靠性｡
保密性
¨[ISO/IEC13335-1:2004]
The property that information is not made available or disclosed to unauthorized individuals,entities,orprocesses.
使信息不泄露给未授权的个人､实体､过程或不使信息为其利用的特性｡
完整性
¨[ISO/IEC13335-1:2004]
Integrity:the property of safe guarding the accuracy and completeness of assets.
保护资产准确性和完备性的特性｡
可用性
¨[ISO/IEC13335-1:2004]
Availability:the property of being accessible and usable upondemand by an authorizedentity.
已授权实体一旦需要就可访问和使用的特性｡
资产
[ISO/IECTR13335-1:2004]
Asset:anything that has value to the organization.
任何对组织有价值的东西｡
威胁
¨[ISO/IECTR13335-1:2004]
Threat:apotential cause of an unwanted incident that may result in harm to a system or organization.
可能对系统或组织造成损害的事件的潜在原因｡
薄弱点
¨[ISO/IECTR13335-1:2004]
Vulnerability:a weakness of an asset or group of assets that can be exploited by one or more threats.
指资产或资产组的能被威胁利用的薄弱点｡
风险
¨[ISOGuide73:2002]
Risk:combination of the probability of an event and its consequence.
指事件发生的可能性及后果的结合
风险管理
¨[ISO/IEC17799:2000]
Process of identifying,controlling and minimizing or eliminating security risks that may affect information systems,for an acceptable cost.
以可接受的费用识别､控制､降低或消除可能影响信息系统的安全风险的过程｡
¨[ISOGuide73:2002]
Coordinated activities to direct and control an organization with regard to risk.
指导和控制组织风险的协调活动
NOTE:Risk management typically includes risk assessment,risk treatment,risk acceptance and risk communication
注:风险管理活动一般包括风险评估､风险处理､风险接受和风险沟通｡
¨[ISO/IECTR13335-1:2004]
The total processof identifying,controlling,and eliminating or minimizing uncertain events that may affect IT system resources.
识别､控制､消除或降低不期望事件影响IT系统资源的全过程｡
风险分析
¨[ISOGuide73:2002]
System at ic use of information to identify sources and to estimate the risk.
系统地使用信息识别来源和估计风险｡
¨[ISO/IECTR13335-1:2004]
The system at ic process of estimating the magnitude of risks.
评估风险大小的系统化的过程｡
风险赋值
¨[ISOGuide73:2002]
Process of comparing the estimated risk against given risk criteria to determine the significance of the risk.
对照给定的风险准则和正在估计的风险,以确定风险严重程度的过程｡
风险评估
¨[ISO/IEC17799:2000]
Assessment of threats to,impactson and vulnerabilities of information and information processing facilities and the likelihood of their occurrence.
对信息和信息处理设施的危害､影响和薄弱点及三者发生的可能性的评估｡
¨[ISOGuide73:2002]
Over all process of risk analysis and riskuation.
风险分析和风险评价的整个过程｡
剩余风险
¨[ISOGuide73:2002]
Risk remaining after risk treatment.
风险处理后残留的风险｡
¨[ISO/IECTR13335-1:2004]
The risk that remains after implementation of the IT security plan.
实施IT安全计划后残留的风险｡
风险接受
¨[ISOGuide73:2002]
Decision to accept a risk.
接受一个风险的决定｡
风险处理
¨[ISOGuide73:2002]
Process of selection and implementation of measures to modify risk.
选择和实施措施以降低风险的处理过程｡
风险降低
¨[ISOGuide73:2002]
Actions taken to lessen the probability,negative consequences,or both,as sociated with a risk.
采取措施降低风险发生的可能性以及与风险相关的负面影响｡
风险转移
¨[ISOGuide73:2002]
Sharing with an other party the burden of loss or benefit of gain,for a risk.
与另一方共同承担风险,从而减轻利益或财产损失的负担｡
