【作者】 孙小明；

【导师】 陈克非； 施建俊；

【作者基本信息】 上海交通大学 ， 软件工程， 2014， 硕士

【摘要】 随着金融企业信息化进程的不断推进，信息安全保障问题显得日益突出，逐渐成为一个关系企业稳健运营、保持竞争优势的关键问题之一。企业内部迫切希望通过加强信息技术风险管理体系及信息安全方面的工作，制定相应的控制措施，以确保满足上级部门的合规要求，提高企业信息系统的可靠性和安全性，防范信息系统事故的发生以及提升企业的形象。同时，为提高金融企业对信息技术风险管理工作的认识，辅助监管部门进行有效监管，引导企业合理建设，提高其信息安全保障能力和风险管理能力，促进企业长期健康地发展，金融监管部门出台了相关的法规，提升监管效率。面对公司内外部因素对信息技术风险管理的要求，如何随着企业信息技术管理工作的深入开展，将信息技术安全管理提升到信息技术风险管理的高度，同时把握机遇解决信息技术内控工作中的问题，有效地提高信息技术风险管理的水准成为公司目前面临的最大挑战之一。因此，本文首先通过对信息技术风险管理在金融企业的现状研究，探讨金融企业风险管理的特点和最佳实践，指导企业风险管理研究的方向。其次，基于金融企业风险现状的评估，构建闭环的企业信息技术风险管理体系，帮助企业实现信息技术全面风险管理，提升风险管理的全面性和高效性。再次，为实现有效的风险管理体系，建立金融企业的信息技术风险评估模型，对企业信息技术风险进行精准评估，为后续风险的有效管控和监控提供基础，从而有效提供企业信息技术风险管理水平。最后，通过上述体系化的研究成果，实现对公司信息技术风险的识别、计量、监测和控制，以及对控制有效性的衡量和监控，确保信息技术对业务的可靠支撑，促进公司信息系统安全、持续、稳健地运行，增强公司核心竞争力和可持续发展能力。本文通过对信息技术风险管理的研究，结合目前金融企业信息技术风险管理的现状，实现了一套适用于金融企业的信息技术风险管理体系。经实际应用，搭建了全面的信息技术风险管理体系，实现全面风险管理，确保了金融企业信息技术风险从信息资产识别、弱点和威胁判断、风险点确认、风险处置、风险再评估以及风险监控等全生命周期管理。同时，为了对信息技术风险进行准确的评估和管理，建立了一套信息技术风险评估模型，为信息技术风险管理体系奠定了基础，作为一种管理工具，也为企业信息技术风险管理水平的提升提供了理论框架。更多还原

【Abstract】 Information security issue is more and more prominent and eventually becomes one keyproblem for stabilizing daily operation and maintaining competitive edge for corporationsaccompanied with the progress of the IT development for the financial companies. Internallythe financial companies want to ensure meeting the regulations of the administration, enhancethe security and stability of the corporate IT system and prevent IT system accidents andpromote corporate images by strengthening IT technical risk management architecture andsystem, creating correspondent control methods.At the same time the financial regulations released relevant laws to increase theregulative efficiency for helping financial companies enhance understanding of the ITtechnical risk management, assist regulations supervising more effectively,lead corporateinvesting rationally, increase its ability for information security and risk managementtherefore improving the development for the corporation in the long run.Facing the requirements for the IT technical risk managements raised both from insideand outside factors around companies, it becomes one of the biggest challenges for companyto raise the management level from IT security management to IT technical risk managementat the same time catching the opportunities to solve the problems occurred in the internal ITtechnical control daily operations and effectively improve IT technical managementstandards.Firstly this article discusses about the features and best practices of the risk managementfor the financial companies, explores the direction for corporate risk management studies bycarefully analyzing the current status of the IT technical risk management in the financialindustry.Secondly, it helps to build up close loop system for corporate IT technical riskmanagement, realize total IT risk management and increase the all-out capability and efficiency of risk management for the financial corporations based on the evaluation of thecurrent risk situation of the financial corporations.Thirdly, in order to create the effective risk management system and build IT technicalrisk evaluation models for financial industry，it provides toolshed to assess the corporate ITmore accurately and lay foundation for the following up risk supervise and control thereforeeffectively improving standard of the corporate IT technical risk management.Finally, we hope to enable companies to recognize, calculate, supervise and controlthe IT technical risks and through accessing and overseeing the effectiveness of the riskcontrol to ensure IT to give business its reliable support, help corporate IT system operatingwith security, consistency and stability therefore increasing the core competence and longterm develop ability.This thesis built a set of IT technical risk management systems fits for the financialcorporations through the studies for the IT technical risk management combining the currentsituation for the corporate IT technical risk management in the financial industry. It creates afull range IT technical risk management mechanism to realize total risk management, secureIT technical risk management from information assets identification, weak points and threatsjudgment, risk points verification, risk treatment, risk re-evaluation and risk supervisionthrough practice. At the same time it creates a set of IT risk evaluation models to lay thefoundation of IT technical risk management mechanism as long as working as a managementtool which also providing theoretical framework for improving corporate IT technical riskmanagement in order to carry out accurate evaluation and management of the IT riskmanagement.更多还原