目前風險分析方法以定性分析為主。但是定性分析方法有很大的局限性：首先，定性的分析方法不是用數學或統計的工具將風險模型化，因此一次風險評估的成敗與執行者的經驗有很大的關系[1]。其次，由于沒有對影響大小給出具體的定量度量，因此使得對控制措施進行成本效益分析變得很困難。但是很多時候，做這種分析往往是必要的。本文
討論風險的定量測量VaR 法在信息安全風險評估中的應用。
關鍵詞：信息安全，VaR 法，風險評估
Abstract： Risk analysis methods based on qualitative measures have some disadvantages. First, qualitative risk analysis methods do not use tools like mathematics and statistics to model the risk, the results of method is vastly depended on the ideas of people who conduct the risk analysis. Second, having not given the quantitative measures of impacts, it is difficult for controls to do cost-benefit analysis. And sometimes, that is very important. In this paper, we applied VaR methods in information security risk assessment.
Keywords ：Information Security, VaR, Risk Assessment