0引言学校、政府部门、金融机构、企事业单位和商业组织等对信息系统的依赖程度日益加深,而高校校园网作为高校教育科研的一项重要基础设施,其规模逐年扩大,网络本身具有的开放性和互联性等特点,使校园网面临着外部黑客入侵、局域网内部攻击、蠕虫病毒、信息失窃、物理故障等各种网络安全威胁。此时信息安全风险评估尤为重要,可以利用风险评估的结果来确定随后的控制策略并选择成本效益合理的、适用的安全对策来规避网络威 0 Introduction Schools, government departments, financial institutions, enterprises and institutions and business organizations rely more and more on the information system, while the college campus network as an important infrastructure for education and research institutions, its size has been expanding year by year, the network itself has Openness and interconnectivity and other characteristics of the campus network faces external hacker attacks, intra-LAN attacks, worms, information theft, physical failure and other network security threats. Information security risk assessment is particularly important at this time, the results of risk assessment can be used to determine the subsequent control strategy and select a cost-effective and appropriate security measures to circumvent the network