Abstract: Information Security (IS) becomes the focus question that people pay attention to, how to build a qualitative model of Information Security Risk Assessment (ISRA) and how to quantitatively analyze the key parts in a number of risk factors are the primary questions that we concerned. We built the ISRA model using Fault Tree Analysis (FAT)，and then by qualitative and quantitative analysis, we analyzed the relationship between risk factors and IS, finding out the main factors that result in Information Security Risk exposure. The result shows the practicability and expandability of this assessment model.

Key words: Information security, ISRA, FAT, Quantitative analysis