The previous approaches to measuring network security are most based on the hypothesis that the related source data can be known well and truly. But in practice,it is very difficult to obtain all the related accurate source data [22]. In this paper, we propose a flexible approach based on attack graphs to measuring security of crucial resources in vulnerable network, which could bring out the accurate result of measuring network security with incomplete input data. Another key improvement is presenting the backward iterative algorithm to solve the problem of cyclic attack paths in measuring security using attack graphs. At the same time, the simulation experiment demonstrates the algorithm can be applied to the large attack graphs.