最初所谓的信息安全风险评估,不过是对电脑操作系统和软件等的简单检查,随着局域网和互联网的发展,评估扩展到网络环境之中。后来,人们渐渐意识到信息安全风险同其它很多风险一样,主因还是人和管理,所以整体的信息安全风险评估逐渐涵盖到企业管理体系。 The first so-called information security risk assessment was simply a check on the computer’s operating system and software. As local area networks and the Internet developed, assessments expanded into the network environment. Later, people came to realize that the information security risks are the same as many other risks, and the main reason is people and management. Therefore, the overall information security risk assessment gradually covers the enterprise management system.