目前风险分析方法以定性分析为主。但是定性分析方法有很大的局限性：首先，定性的分析方法不是用数学或统计的工具将风险模型化，因此一次风险评估的成败与执行者的经验有很大的关系[1]。其次，由于没有对影响大小给出具体的定量度量，因此使得对控制措施进行成本效益分析变得很困难。但是很多时候，做这种分析往往是必要的。本文讨论风险的定量测量VaR 法在信息安全风险评估中的应用。关键词：信息安全，VaR 法，风险评估Abstract： Risk analysis methods based on qualitative measures have some disadvantages. First, qualitative risk analysis methods do not use tools like mathematics and statistics to model the risk, the results of method is vastly depended on the ideas of people who conduct the risk analysis. Second, having not given the quantitative measures of impacts, it is difficult for controls to do cost-benefit analysis. And sometimes, that is very important. In this paper, we applied VaR methods in information security risk assessment.Keywords ：Information Security, VaR, Risk Assessment