Evaluation or Assessment

我们经常会用到评估一词,但是到底是evaluation, 还是assessment?接下来让我们来分析一下两者的区别。
Evaluation
Cambridge dictionary中释义:the process of judging or calculating the quality, importance, amount, or value of something, 也就是说evaluation 常用来评判或者计算某事物的质量、数量、重要性、价值的过程
Assessment
Cambridge dictionary中释义:the act of judging or deciding the amount, value, quality, or importance of something, or the judgment or decision that is made, evaluation常用来表示判断或者决定某事物的数量、价值、质量、重要性的行为。

意思上差不多,我个人有时候会混用。但assessment偏所有分析,evaluation偏价值分析。如果只是分析各种可能性,用assessment,但如果用到价值判断分析或者评价影响时,可用evaluation。

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
ISO 27007 标准Information technology — Security techniques — Guidelines for information security management systems auditing Introduction this Standard ISO 19011 Guidelines for quality and/or environmental management systems auditing is an International Standard which provides guidance on the principles of auditing, managing audit programmes, conducting quality management system audits and environmental management system audits, as well as guidance on the competence of quality and environmental management system auditors. If organizations want to conduct internal or external audits of Information Security Management Systems (ISMS) in accordance with ISO/IEC 27001:2005, some additional guidance to the standard ISO 19011 are necessary and are provided by this International Standard. The text in this International Standard follows the structure of ISO 19011, and the additional ISMS-specific guidance on the application of ISO 19011 for ISMS audits are identified by the letters “IS”. This International Standard provides guidance on the management of audit programmes, the conduct of internal or external audits of ISMSs, as well as on the competence and evaluation of auditors. It is intended to apply to a broad range of potential users, including auditors, organizations implementing ISMSs, organizations needing to conduct audits of ISMSs, and organizations involved in auditor certification or training, in certification/registration of management systems, in accreditation or in standardization in the area of conformity assessment.
ISO/IEC 27005:2011英文版BS|So/EC27005:201 so/EC27005:2011E 9.2 Risk modification 22 9. 3 Risk retention 面BB1面面 9.4 Risk avoidance 9.5 Risk sharing 10 Information security risk acceptance.. 24 11 Information security risk communication and consultation 24 12 Information security ris k monitoring and review 25 12.1 Monitoring and review of risk factors 25 12.2 Risk management monitoring, review and improvement..... 26 Annex A(informative )Defining the scope and boundaries of the information security risk management process A1 Study of the organization.. 28 A2 List of the constraints affecting the organization.. A3 List of the legislative and regulatory references applicable to the organization 31 A.4 List of the constraints affecting the scope Annex B (informative) Identification and valuation of assets and impact assessment 量国 面面国 33 B. 1 Examples of asset identification 33 B.1.1 The identification of primary assets 33 0m-0sz B12 List and description of supporting assets…………… 34 B.2 Asset va| uation.… 38 B3 Impact assessment............ n41 Annex C (informative)Examples of typical threats 42 Annex D (informative) Vulnerabilities and methods for vulnerability assessment..... D1 Examples of vulnerabilities 45 D2 Methods for assessment of technical vulnerabilities n…48 Annex E(informative)Information security risk assessment approaches 50 E.1 High-level information security risk assessment.……… 50 E2 Detailed information security risk assessment...-............. E22 Example2 Ranking of Threats by Measures of RisK.……… 51 E.2.1 Example 1 Matrix with predefined values 52 E.2.3 Example 3 Assessing a value for the likelihood and the possible consequences of risks... 54 Annex F(informative) Constraints for risk modification.. 面 56 Annex G(informative) Differences in definitions between ISO/EC 27005: 2008 and ISo/EC 27005:2011 58 Bibliography 68 O ISO/EC 2011-All rights reserved BS ISO/EC27005:2011 ISO/EC27005:2011(E Foreword Iso(the International Organization for Standardization) and Ec(the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISo or EC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISo and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISONEC JTC 1 International Standards are drafted in accordance with the rules given in the ISo/EC Directives, Part 2 The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 of the national bodies casting a vote Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. Iso and iEC shall not be held responsible for identifying any or all such patent rights 0m-0sz ISO/EC 27005 was prepared by Joint Technical Committee ISO/EC JTC 1, Information technology Subcommittee SC 27, / T Security techniques This second edition cancels and replaces the first edition(ISO/EC 27005: 2008)which has been technically revised O ISO/EC 2011-All rights reserved BS|So/EC27005:201 so/EC27005:2011E Introduction This International Standard provides guidelines for information security risk management in an organization supporting in particular the requirements of an information security management(ISMS) according to ISO/EC 27001. However, this International Standard does not provide any specific method for information security risk management. It is up to the organization to define their approach to risk management, depending for example on the scope of the ISMS, context of risk management, or industry sector. A number of existing methodologies can be used under the framework described in this International Standard to implement the requirements of an ISMS This International Standard is relevant to managers and staff concerned with information security risk management within an organization and, where appropriate, external parties supporting such activities 0m-0sz O ISO/EC 2011-All rights reserved BS ISO/EC27005:2011 INTERNATIONAL STANDARD ISO/EC27005:2011(E Information technology- Security techniques-Information security risk management 1 Scope This International Standard provides guidelines for information security risk management This International standard supports the general concepts specified in iso/EC 27001 and is designed to assist the satisfactory implementation of information security based on a risk management approach Knowledge of the concepts, models, processes and terminologies described in ISo/EC 27001 and ISO/EC 27002 is important for a complete understanding of this International Standard This International Standard is applicable to all types of organizations (e.g. commercial enterprises, 0m-0sz government agencies, non-profit organizations)which intend to manage risks that could compromise the organizations information securit 2 Normative references m The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document(including any amendments) applies ISO/EC 27000, Information technology Security techniques Information security management systems-Overview and vocabulary ISO/EC 27001: 2005, Information technology Security techniques Information security management systems- Requirements 3 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 27000 and the following apply NOTE Differences in definitions between iso/ec 27005: 2008 and this international standard are shown in Annex g 3.1 consequence outcome of an event( 3.3)affecting objectives ISO Guide 73: 2009 NOTE 1 An event can lead to a range of consequences NoTE 2 A consequence can be certain or uncertain and in the context of information security is usually negative nOtE 3 Consequences can be expressed qualitatively or quantitatively NOTE 4 Initial consequences can escalate through knock-on effects O ISO/EC 2011-All rights reserved BS|So/EC27005:201 so/EC27005:2011E 32 control measure that is modifying risk(3.9) [SO Guide 73: 2009 structure, which can be administrative, technical, management, or legal in nature which modify information security Inal NOTE 1 Controls for information security include any process, policy, procedure, guideline, practice or organizati NOTE 2 Controls may not always exert the intended or assumed modifying effect NOTE 3 Control is also used as a synonym for safeguard or countermeasure 3.3 event occurrence or change of a particular set of circumstances [So Guide 73: 2009 noTE 1 An event can be one or more occurrences and can have several causes NOTE 2 An event can consist of something not happening 0m-0sz NOTE 3 An event can sometimes be referred to as an"incident or accident 3.4 external context external environment in which the organization seeks to achieve its objectives [ISO Guide 73: 2009 NOTE External context can include the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive environment, whether international, national, regional or local key drivers and trends having impact on the objectives of the organization; and relationships with, and perceptions and values of, external stakeholders 3.5 internal context nternal environment in which the organization seeks to achieve its objectives [SO Guide 73: 2009 N○TE Internal context can include governance, organizational structure, roles and accountabilities; policies, objectives, and the strategies that are in place to achieve them the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people processes, systems and technologies): information systems, information flows and decision-making processes(both formal and informal); relationships with, and perceptions and values of, internal stakeholders the organizations culture standards, guidelines and models adopted by the organization; and form and extent of contractual relationship O ISO/EC 2011-All rights reserved BS|SO/EC27005:2011 ISO/EC27005:2011(E) 3.6 level of risk magnitude of a risk(3. 9), expressed in terms of the combination of consequences (3. 1)and their likelihood (3.7) [ISO Guide 73: 2009] 3.7 likelihood chance of something happening [ISo Guide 73: 2009] NOTE 1 In risk management terminology, the word "likelihood"is used to refer to the chance of something happening whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or mathematically(such as a probability or a frequency over a given time period) NOTE2 The English term"likelihood" does not have a direct equivalent in some languages; instead, the equivalent of the term "probability is often used. However, in English, "probability"is often narrowly interpreted as a mathematical term Therefore, in risk management terminology, "likelihood" is used with the intent that it should have the same broad interpretation as the term "probability has in many languages other than English 3.8 0m-0sz residual risk risk (3. 9)remaining after risk treatment (3. 17) [ISO Guide 73: 2009 NOTE 1 Residual risk can contain unidentified risk NoTE 2 Residual risk can also be known as"retained risk 3.9 risk effect of uncertainty on objectives [ISO Guide 73: 20091 NOTE 1 An effect is a deviation from the expected -positive and/or negative OTE 2 Objectives can have different aspects (such as financial, health and safety, information security, and environmental goals)and can apply at different levels (such as strategic, organization-wide, project, product and process note 3 Risk is often characterized by reference to potential events(3.3 )and consequences(3.1), or a combination o these NoTE 4 Information security risk is often expressed in terms of a combination of the consequences of an information security event and the associated likelihood(3. 9)of occurrence NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood NotE 6 Information security risk is associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets and thereby cause harm to an organization. 3.10 risk analysis rocess to comprehend the nature of risk and to determine the level of risk (3.6) [SO Guide 73: 2009 O ISO/EC 2011-All rights reserved BS|So/EC27005:201 so/EC27005:2011E NoTE 1 Risk analysis provides the basis for risk evaluation and decisions about risk treatment NoTE 2 Risk analysis includes risk estimation 3.11 risk assessment overall process of risk identification(3. 15), risk analysis(3.10)and risk evaluation (3.14) [So Guide 73: 2009 3.12 risk communication and consultation continual and iterative processes that an organization conducts to provide, share or obtain information, and to engage in dialogue with stakeholders( 3.18)regarding the management of risk(3. 9) [So Guide 73: 2009] NoTE 1 The information can relate to the existence, nature, form, likelihood, significance, evaluation, acceptability and treatment of risk NOTE 2 Consultation is a two-way process of informed communication between an organization and its stakeholders on an issue prior to making a decision or determining a direction on that issue. Consultation is 0m-0sz a process which impacts on a decision through influence rather than power; and an input to decision making, not joint decision making 3.13 risk criteria terms of reference against which the significance of a risk (3. 9)is evaluated [So Guide 73: 2009] NOTE 1 Risk criteria are based on organizational objectives, and external and internal context NOTE 2 Risk criteria can be derived from standards, laws, policies and other requirements 3.14 risk evaluation process of comparing the results of risk analysis(3.10)with risk criteria(3. 13)to determine whether the risk and/or its magnitude is acceptable or tolerable [SO Guide 73: 2009] NOTE Risk evaluation assists in the decision about risk treatment 3.15 risk identification process of finding, recognizing and describing risks [ISO Guide 73: 2009] NOTE 1 Risk identification involves the identification of risk sources, events their causes and their potential consequences. NOTE 2 Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and stakeholders needs O ISO/EC 2011-All rights reserved BS|SO/EC27005:2011 ISO/EC27005:2011(E) 3.16 risk management coordinated activities to direct and control an organization with regard to risk [ SO Guide73:2009] NOTE This International Standard uses the term process to describe risk management overall. The elements withir the risk management process are termed'activities 3.17 risk treatment process to modify risk [ISO Guide 73: 2009 NOTE 1 Risk treatment can inyolye avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk; taking or increasing risk in order to pursue an opportunity removing the risk source changing the likelihood 0m9 changing the consequences sharing the risk with another party or parties(including contracts and risk financing); and retaining the risk by informed choice NOTE 2 Risk treatments that deal with negative consequences are sometimes referred to as risk mitigation","risk elimination"," risk prevention"and" risk reduction NOtE3 Risk treatment can create new risks or modify existing risks 3.18 stakeholder person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activit [ISO Guide 73: 2009 NOTE a decision maker can be a stakeholder 4 Structure of this International standard This International Standard contains the description of the information security risk management process and its activities The background information is provided in Clause 5 a general overview of the information security risk management process is given in clause 6 All information security risk management activities as presented in Clause 6 are subsequently described in the following clauses Context establishment in clause 7 Risk assessment in Clause 8 Risk treatment in Clause 9 O ISO/EC 2011-All rights reserved
### 回答1: SAR(合成孔径雷达)影像质量评估是一项用于评估合成孔径雷达图像质量的过程。SAR是一种采用雷达原理进行成像的技术,它可以对地球表面进行高分辨率的观测,具有良好的穿透障碍物的能力,并且不受天气条件的限制。因此,SAR影像质量评估对于正确地解释和分析雷达数据非常重要。 SAR影像质量评估可以通过以下几个方面来进行: 1. 分辨率:分辨率是指雷达影像中可以识别的最小物体大小。高分辨率意味着可以看到更小的细节,因此更好地了解地表特征。 2. 噪声:噪声是影响图像质量的一个重要因素,它可能会掩盖地表特征并降低图像的可用性。通过对图像进行噪声滤波等处理,可以减少噪声的影响。 3. 斑点:斑点是指图像中的不规则亮度变化,它可能来自于雷达系统的不稳定性。通过对图像进行斑点滤波等处理,可以减少斑点对图像质量的影响。 4. 平滑度:平滑度是指图像中的亮度变化程度。平滑度不宜过高,否则可能会造成细节的丢失。因此,合理的平滑度可以提高图像的质量。 5. 几何校正:SAR影像在获取过程中可能会发生几何失真,这将影响图像的准确性和质量。通过对图像进行几何校正,可以提高图像的质量和准确性。 总之,SAR影像质量评估是确保合成孔径雷达图像质量和准确性的重要步骤。合理评估和处理SAR影像质量,将有助于提高对地表特征的解释能力,并促进对雷达数据的正确分析和利用。 ### 回答2: SAR(Synthetic Aperture Radar)影像质量评估是对合成孔径雷达所生成的影像进行评估的过程。SAR影像质量评估的目的是确保影像的准确性和可用性。 在SAR影像质量评估中,常用的评估指标包括图像分辨率、噪声、辐射校准、几何校正等。首先,图像分辨率是评估SAR影像质量的重要指标之一,它衡量了影像中目标的清晰度和细节程度。图像分辨率较高意味着能够更准确地识别和分析目标。 其次,噪声是影响SAR影像质量的另一个重要因素。SAR影像在获取过程中会受到多种干扰源的影响,如大气湿度、电磁干扰等,这些干扰会导致影像中出现噪点。评估SAR影像噪声水平的准确性,有助于提高图像质量。 此外,辐射校准和几何校正也是SAR影像质量评估的关键步骤。辐射校准用于确保影像中灰度值的准确性和一致性,而几何校正用于纠正影像中的几何畸变,使影像更符合实际地物的形状。 为了进行SAR影像质量评估,可以采用目视评估和客观评估两种方法。目视评估依靠人眼对影像进行主观判断,而客观评估则是基于一系列算法和指标进行自动化评估。两种方法结合使用,可以更全面地评估SAR影像的质量。 综上所述,SAR影像质量评估是一项关键的工作,它可以确保SAR影像的准确性和可用性。通过评估图像分辨率、噪声、辐射校准和几何校正等指标,可以得到一个准确地评估SAR影像质量的结果。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值