Yuan Wei-hua’s research while affiliated with Anhui Jianzhu University and other places

In this paper, based on the preliminary research results K-PRS-ISMCS and PRS-ISMCS, a variety of risks existed in the process of IT governance are firstly analyzed; then a full-life cycle, multi-layered structure of IT risk governance ITG-HRCM (Hierarchical risk control model) integrated with ERMF and COBIT based on PRS-ISMCS is put forward with the description of the model function; thirdly a kind of improved risk quantization and calculation method is described; finally the work of experimental simulation is done to various risks in the process of IT governance, which proves that ITG-HRCM with its improved risk quantitative calculation method can meet the demand and expectations of information security objectives in IT governance.

In this paper, according to the characteristics of organization's Information Systems (IS), knowledge resources related to IS are classified into three parts. Based on knowledge management of the three perspectives -Process Controlling, Resources Protecting and Realization of Security Objectives for IS, elements of information security risk and their relationships are analyzed, and then the three-dimensional model of security risk management and control system K-PRS-ISMCS is built; lastly the improved management and control framework K-PRS-PDCA based on perspectives of organizations' management and life cycle of Information Systems is set up.

Security issues of information system is becoming increasingly important as information is a kind of critical asset and the normal operating of information must be built on secure information system. In this paper, elements of information security risks and their relationships are analyzed and the three-dimensional security system model PRS-ISMCS and improved management process PRS-PDCA of information system are built from such views as process controlling, resource protecting of information system, and security objectives based on the characteristics of information system.