Аннотация
This article proposes a combined method for managing information system security risks based on expert assessments and risk-oriented patterns. The scores were obtained by conducting a questionnaire (expert assessment), as well as using the Common Vulnerability Scoring System (CVSS). CVSS was used to calculate vulnerability level and threat likelihood metrics after taking countermeasures. This method can be used to prioritize information security risks, as well as to determine information security requirements. Attacks on information leak prevention systems are simulated. The priorities of the risks associated with these attacks have been identified. Such systems can be used in SOC and CERT work. Therefore, the method can be used when building business processes related to SOC and CSIRT.