Abstract: Deep analysis and research has been made on general computer module and qualitative module of information security risk assessment.Based on the comparison of characters for qualitative and quantitative risk assessment models, a new quantitative method for information security risk assessment is proposed.This method makes it more scientific and accurate to calculate the risk in the process of assessing information security risk, thereby, solving the preexisting problems in quantitative analysis, such as rough calculation, inaccuracy and the difficulty in distinguishing the importance of risk.