信息安全风险评估方案设计与应用
|
摘要
当今社会,网络和重要信息系统的基础性、全局性作用日益增强,国民经济和社会对基础信息网络和重要信息系统的依赖性越来越大,事关国家经济和人民生活的金融、电力、电信等国家基础设施系统,其运行都依赖于信息网络系统。这些系统一旦发生问题,轻则导致经济损失和社会生活不便,重则会使整个国家的政治、经济或军事面临着新的挑战。
目前国内信息系统的安全现状正处于单个安全威胁向混合安全威胁变化的趋势中,存在的主要问题是在如此复杂的信息网络环境中首先就需要了解有哪些风险,评估存在的风险,预测其发生的可能性以及对信息系统建设单位的影响程度,然后尽可能量化风险,根据优先顺序,采取适当的预防措施。
基于此背景和现状,本文主要论述了信息安全风险评估在信息系统使用过程中的重要性和必要性,对网络、操作系统、应用程序等的安全性、脆弱性和威胁进行测定的方法和依据。系统地分析网络与信息系统所面临的威胁及其存在的脆弱性,评估安全事件一旦发生可能造成的危害程度,提出有针对性地抵御威胁的防护对策和整改措施。信息安全风险评估方案设计和应用过程均依据了国家及国际先进的信息安全技术和管理标准、原则,体现了风险评估的先进性。本文形成了信息安全风险评估具体的方案设计,并以此方案为模板应用于山东高速公路集团信息系统的风险评估实施,今后也可为各类信息系统的建设单位所使用。
综上所述,信息安全风险评估方案设计与应用能够帮助信息系统的管理者建立信息安全管理框架,了解目前存在的安全风险和威胁,防范和化解信息安全风险,将风险控制在可接受的水平,进而建立安全策略、IT安全体系,最大限度地保障网络和信息系统的安全。此外,在国家大力推行信息系统安全等级保护的同时,本文的设计与应用将等级保护与风险评估科学的结合在一起,为企事业单位更好的理解等级保护的含义、准确地为信息系统确定等级提供依据,从而指导用户单位运用技术和管理的手段对信息系统的风险进行有效评估,以确保信息系统合乎相应的安全等级的标准,达不到相应安全等级的信息系统可采纳风险评估报告进行整改。
我认为本文有两点还需进一步改进和完善。一是对系统业务流程的梳理,在安全域划分后,业务系统分离成多个子系统,没有把子系统按照业务流程联系重新组合,在进行信息安全风险评估时出现多次重复性工作;二是运用IT项目管理的方法即采用IT服务管理、控制与流程将风险评估工作流程化、规范化、标准化,更有效的控制风险评估达到预期目标。项目管理流程应该进一步细化,经过这次应用,对信息安全风险评估实施过程中的工作量、分工有了更深刻的认识,在今后的工作中部分环节可以精简,以实现更合理的项目进度和实施管理。
Today, the networks and information systems are playing an important and global role as the essential foundation of our society, and national economic and social networks dependent more and more on important basic information systems, and are related to the national economy and livelihood of the people of finance, electricity, national infrastructure such as telecommunications systems, their operation is dependent on the information network system. These systems in case of questions, ranging from economic losses and cause inconvenience to social life, heavy is the whole country's political, economic or military is facing new challenges.
At present, the safety of the system status information is in a single security threat to the security threat changes in a mixed trend, the main problems are in such a complex network environment information necessary to first know what the risks, assess risks, predict its occurrence the possibility of information systems as well as the impact of construction units, and then quantify the risks as far as possible, according to the order of priority, to take appropriate preventive measures.
Based on this background and the status quo, this paper focuses on information security risk assessment information system in the course of the importance and necessity of the network, operating system, applications such as security, vulnerability and threats were determined based on the methods and . Systematic analysis of network and information systems threats and vulnerabilities, assess the security incidents happen as soon as possible the extent of the harm, there is targeted to the protection against the threat of countermeasures and rectification measures. Information security risk assessment process design and application programs are based on a national and international advanced technology and management of information security standards, principles, reflecting the advanced nature of the risk assessment. In this paper, the formation of a specific information security risk assessment of the program design, and used as a template to program Shandong Expressway Group's risk assessment information system implementation, the future for all kinds of information systems used by construction units.
To sum up, information security risk assessment program design and application of information systems can assist managers of information security management framework set up to understand the current security risks and threats, prevent and resolve information security risks, risk control will be at an acceptable level, and then set up security policies, IT security system, to maximize the protection of networks and information systems. In addition, efforts at the national level the implementation of information system security protection at the same time, the paper design and application of the Level protection and risk assessment of the combination of science, for enterprises a better understanding of the meaning of the protection of Level and accurate information systems to determine the Level to provide a basis in order to guide the user units of the use of technology and management information systems by means of an effective risk assessment, to ensure that the information system in line with the appropriate level of security standards, amounting to less than the corresponding level of security of information systems may adopt a risk assessment report rectification.
This article has two points in my opinion needs to be further improved and perfected. First, the operational flow of the carding system, divided in the security domain, the business system separated into a number of subsystems, the subsystem is not in accordance with the combination of business process re-contact, in information security risk assessment when many repetitive work; are two the use of IT project management method that is adopted IT service management, flow control and flow of risk assessment, standardization, standardization, more effective control of risk assessment to achieve the desired goal. Project management processes should be further refined through the application of information security risk assessment of the workload of the implementation process, the division has a better understanding of the future at some aspect of the job can be streamlined in order to achieve a more reasonable project schedule and implementation of management.
目前国内信息系统的安全现状正处于单个安全威胁向混合安全威胁变化的趋势中,存在的主要问题是在如此复杂的信息网络环境中首先就需要了解有哪些风险,评估存在的风险,预测其发生的可能性以及对信息系统建设单位的影响程度,然后尽可能量化风险,根据优先顺序,采取适当的预防措施。
基于此背景和现状,本文主要论述了信息安全风险评估在信息系统使用过程中的重要性和必要性,对网络、操作系统、应用程序等的安全性、脆弱性和威胁进行测定的方法和依据。系统地分析网络与信息系统所面临的威胁及其存在的脆弱性,评估安全事件一旦发生可能造成的危害程度,提出有针对性地抵御威胁的防护对策和整改措施。信息安全风险评估方案设计和应用过程均依据了国家及国际先进的信息安全技术和管理标准、原则,体现了风险评估的先进性。本文形成了信息安全风险评估具体的方案设计,并以此方案为模板应用于山东高速公路集团信息系统的风险评估实施,今后也可为各类信息系统的建设单位所使用。
综上所述,信息安全风险评估方案设计与应用能够帮助信息系统的管理者建立信息安全管理框架,了解目前存在的安全风险和威胁,防范和化解信息安全风险,将风险控制在可接受的水平,进而建立安全策略、IT安全体系,最大限度地保障网络和信息系统的安全。此外,在国家大力推行信息系统安全等级保护的同时,本文的设计与应用将等级保护与风险评估科学的结合在一起,为企事业单位更好的理解等级保护的含义、准确地为信息系统确定等级提供依据,从而指导用户单位运用技术和管理的手段对信息系统的风险进行有效评估,以确保信息系统合乎相应的安全等级的标准,达不到相应安全等级的信息系统可采纳风险评估报告进行整改。
我认为本文有两点还需进一步改进和完善。一是对系统业务流程的梳理,在安全域划分后,业务系统分离成多个子系统,没有把子系统按照业务流程联系重新组合,在进行信息安全风险评估时出现多次重复性工作;二是运用IT项目管理的方法即采用IT服务管理、控制与流程将风险评估工作流程化、规范化、标准化,更有效的控制风险评估达到预期目标。项目管理流程应该进一步细化,经过这次应用,对信息安全风险评估实施过程中的工作量、分工有了更深刻的认识,在今后的工作中部分环节可以精简,以实现更合理的项目进度和实施管理。
Today, the networks and information systems are playing an important and global role as the essential foundation of our society, and national economic and social networks dependent more and more on important basic information systems, and are related to the national economy and livelihood of the people of finance, electricity, national infrastructure such as telecommunications systems, their operation is dependent on the information network system. These systems in case of questions, ranging from economic losses and cause inconvenience to social life, heavy is the whole country's political, economic or military is facing new challenges.
At present, the safety of the system status information is in a single security threat to the security threat changes in a mixed trend, the main problems are in such a complex network environment information necessary to first know what the risks, assess risks, predict its occurrence the possibility of information systems as well as the impact of construction units, and then quantify the risks as far as possible, according to the order of priority, to take appropriate preventive measures.
Based on this background and the status quo, this paper focuses on information security risk assessment information system in the course of the importance and necessity of the network, operating system, applications such as security, vulnerability and threats were determined based on the methods and . Systematic analysis of network and information systems threats and vulnerabilities, assess the security incidents happen as soon as possible the extent of the harm, there is targeted to the protection against the threat of countermeasures and rectification measures. Information security risk assessment process design and application programs are based on a national and international advanced technology and management of information security standards, principles, reflecting the advanced nature of the risk assessment. In this paper, the formation of a specific information security risk assessment of the program design, and used as a template to program Shandong Expressway Group's risk assessment information system implementation, the future for all kinds of information systems used by construction units.
To sum up, information security risk assessment program design and application of information systems can assist managers of information security management framework set up to understand the current security risks and threats, prevent and resolve information security risks, risk control will be at an acceptable level, and then set up security policies, IT security system, to maximize the protection of networks and information systems. In addition, efforts at the national level the implementation of information system security protection at the same time, the paper design and application of the Level protection and risk assessment of the combination of science, for enterprises a better understanding of the meaning of the protection of Level and accurate information systems to determine the Level to provide a basis in order to guide the user units of the use of technology and management information systems by means of an effective risk assessment, to ensure that the information system in line with the appropriate level of security standards, amounting to less than the corresponding level of security of information systems may adopt a risk assessment report rectification.
This article has two points in my opinion needs to be further improved and perfected. First, the operational flow of the carding system, divided in the security domain, the business system separated into a number of subsystems, the subsystem is not in accordance with the combination of business process re-contact, in information security risk assessment when many repetitive work; are two the use of IT project management method that is adopted IT service management, flow control and flow of risk assessment, standardization, standardization, more effective control of risk assessment to achieve the desired goal. Project management processes should be further refined through the application of information security risk assessment of the workload of the implementation process, the division has a better understanding of the future at some aspect of the job can be streamlined in order to achieve a more reasonable project schedule and implementation of management.
引文
[1]张基温 信息系统安全教程 北京:清华大学出版社,2007.7
[2]费洪晓,谢文彪,戴宏伟 入侵检测系统攻击特征库的设计与实现[J]计算机系统应用,2007,02:116-119
[3]吴亚非等 信息安全风险评估 北京:清华大学出版社,2007.4
[4]李娟,梁军,李永杰 信息安全风险评估研究[J]计算机与数字工程,2006,34(11):64-66,71
[5]赵战生,谢宗晓 信息安全风险评估--概论、方法和实践北京:中国标准出版社,2007.8
[6]全国信息安全标准化技术委员会 信息系统安全等级保护基本要求(国家标准报批稿)
[7]E rikJ ohansson,Po ntusJo hnson.A ssessmentof en terprisein formations ecurity-anarc hite ctu reth eoryd iagramd efinition[C].Pr oceedingsC SER2005,March2 3-25.136-146
[8]美国国防部,TCSEC,可信计算机安全评价标准,美国:国防部
[9]英、法、德、荷四国国防部,ITSEC,信息技术安全评估标准,英、法、德、荷四国国防部,1991
[10](英)乔丹,(英)赛尔库克著,汤大马译IT风险基于IT治理的风险管理之道 清华大学出版社,2006.12
[11]翟雪荣,刘志刚,卞春 信息系统信息安全风险管理的发展趋势分析[J],农业网络信息,2007(12):116-118
[12]国家标准化管理委员会,GB/T-20984-2007,信息安全风险评估规范,北京:国家标准化管理委员会,2007.11
[13]孙强,董雨欣等 定量的信息安全风险评估计算模型的研究[J]计算机研究与发展,2006年(12):594-598
[14]全国信息安全技术水平考试教材编委会 全国信息安全水平考试一级学员教材 北京:电子工业出版社,2006.6
[15]中国标准出版社,信息安全技术信息安全事件分类分级指南GB/Z20986-2007,北京:中国标准出版社,2007.09
[16]国家计算机网络应急技术处理中心(CNCERT/CC),全国网络与信息技术培训项目管理中心(NTC-MC),网络安全应急实践指南,北京:电子工业出版社,2008.4
[17](美)格林(Greene,S.S),陈宗斌译 安全策略与规程:原理与实践北京:清华大学出版社,2008.10
[18]赵冬梅,马建峰,王跃生 信息系统的模糊风险评估模型[J]通信学报,2007.28(4):51-56
[19]张同光 信息安全技术实用教程 北京:电子工业出版社,2008.7
[20]赵战生 中国信息安全体系结构基本框架与构想[J]北京:计算机安全2002-1-5总期号11
[21]唐晓波 IT项目管理 北京:科学出版社,2008.1
[22](美)史蒂文斯(W.Richard Stevens)著,范建华等译TCP/IP详解(卷1:协议) 北京:机械工业出版社,2007.11
[23]黄洪 加强应用系统源代码安全的风险管理 信息网络安全,2008(10):56-58
[24]吴志钊 网络黑金时代黑客攻击的有效防范 产业与科技论坛,2008.(7).6:119-120
[25]范红 信息安全风险评估规范国家标准理解与实施 北京:中国标准出版社,2008.02
[26]全国信息安全标准化技术委员会 信息安全管理体系ISO/IEC27001 北京:中国标准出版社,2007.09
[27]中国信息安全产品测评认证中心 中国信息安全产品政府采购指南(2007年鉴) 安徽:中国科学技术大学出版社,2007.06
[28]戴宗坤 信息安全法律法规与管理 重庆:重庆大学出版社,2005.5
[29]陈珍成 信息安全管理体系审核指南 北京:中国标准出版社,2007.7
[30]孙建明 浅谈网络安全中的漏洞扫描技术 中国科技博览,2008.(21):49-50
[31]全国信息安全标准化技术委员会,GB/T 18336信息技术安全技术信息技术安全性评估准则北京:中国标准出版社,2001
[32]朱方洲 基于BS7799的信息系统安全风险评估研究[D]合肥:合肥工业大学,2007
[33]科飞管理咨询公司 BS 7799和IS0/IEC 17799信息安全管理体系及其认证认可相关知识问答北京:中国标准出版社,2003.9
[34]朱海林IT服务管理、控制与流程北京:机械工业出版社,2006.8
[35]汪立东 操作系统安全评估与审计增强:[博士学位论文]哈尔滨:哈尔滨工业大学,2002
[36]秦志光,张凤荔 计算机病毒原理与防范 北京:人民邮电出版社,2007.8
[37]钱雪忠 数据库原理及应用(第2版) 北京:北京邮电大学出版社,2007.8
[38]窦玉杰 网络服务器配置大全 北京:科学出版社,2006.5
[39]文洋 网管员使用大全 北京:电子工业出版社,2008.6
[40](美)麦肯兰勃(McNab,C.)著,王景新译Network Security Assessment,北京:中国电力出版社,2005.12
[41]刘洪发,唐洪 网络存储及灾难恢复技术[M]电子工业出版社,2008
[42]陈纪元 浅议数据备份的策略和方法[J]福建电脑,2007(10):63-64
[43]全国信息安全标准化技术委员会,GB/T 20988-2007信息安全技术信息系统灾难恢复规范北京:中国标准出版社,2007.9
[44]Kayashima M,Nagai Y,Terada[M].Network Security for the Broadband Era[J].Hitachi Review,2002,51(2):70-73
[45]李剑 信息安全培训教程 北京:北京邮电大学出版社,2008.3
[2]费洪晓,谢文彪,戴宏伟 入侵检测系统攻击特征库的设计与实现[J]计算机系统应用,2007,02:116-119
[3]吴亚非等 信息安全风险评估 北京:清华大学出版社,2007.4
[4]李娟,梁军,李永杰 信息安全风险评估研究[J]计算机与数字工程,2006,34(11):64-66,71
[5]赵战生,谢宗晓 信息安全风险评估--概论、方法和实践北京:中国标准出版社,2007.8
[6]全国信息安全标准化技术委员会 信息系统安全等级保护基本要求(国家标准报批稿)
[7]E rikJ ohansson,Po ntusJo hnson.A ssessmentof en terprisein formations ecurity-anarc hite ctu reth eoryd iagramd efinition[C].Pr oceedingsC SER2005,March2 3-25.136-146
[8]美国国防部,TCSEC,可信计算机安全评价标准,美国:国防部
[9]英、法、德、荷四国国防部,ITSEC,信息技术安全评估标准,英、法、德、荷四国国防部,1991
[10](英)乔丹,(英)赛尔库克著,汤大马译IT风险基于IT治理的风险管理之道 清华大学出版社,2006.12
[11]翟雪荣,刘志刚,卞春 信息系统信息安全风险管理的发展趋势分析[J],农业网络信息,2007(12):116-118
[12]国家标准化管理委员会,GB/T-20984-2007,信息安全风险评估规范,北京:国家标准化管理委员会,2007.11
[13]孙强,董雨欣等 定量的信息安全风险评估计算模型的研究[J]计算机研究与发展,2006年(12):594-598
[14]全国信息安全技术水平考试教材编委会 全国信息安全水平考试一级学员教材 北京:电子工业出版社,2006.6
[15]中国标准出版社,信息安全技术信息安全事件分类分级指南GB/Z20986-2007,北京:中国标准出版社,2007.09
[16]国家计算机网络应急技术处理中心(CNCERT/CC),全国网络与信息技术培训项目管理中心(NTC-MC),网络安全应急实践指南,北京:电子工业出版社,2008.4
[17](美)格林(Greene,S.S),陈宗斌译 安全策略与规程:原理与实践北京:清华大学出版社,2008.10
[18]赵冬梅,马建峰,王跃生 信息系统的模糊风险评估模型[J]通信学报,2007.28(4):51-56
[19]张同光 信息安全技术实用教程 北京:电子工业出版社,2008.7
[20]赵战生 中国信息安全体系结构基本框架与构想[J]北京:计算机安全2002-1-5总期号11
[21]唐晓波 IT项目管理 北京:科学出版社,2008.1
[22](美)史蒂文斯(W.Richard Stevens)著,范建华等译TCP/IP详解(卷1:协议) 北京:机械工业出版社,2007.11
[23]黄洪 加强应用系统源代码安全的风险管理 信息网络安全,2008(10):56-58
[24]吴志钊 网络黑金时代黑客攻击的有效防范 产业与科技论坛,2008.(7).6:119-120
[25]范红 信息安全风险评估规范国家标准理解与实施 北京:中国标准出版社,2008.02
[26]全国信息安全标准化技术委员会 信息安全管理体系ISO/IEC27001 北京:中国标准出版社,2007.09
[27]中国信息安全产品测评认证中心 中国信息安全产品政府采购指南(2007年鉴) 安徽:中国科学技术大学出版社,2007.06
[28]戴宗坤 信息安全法律法规与管理 重庆:重庆大学出版社,2005.5
[29]陈珍成 信息安全管理体系审核指南 北京:中国标准出版社,2007.7
[30]孙建明 浅谈网络安全中的漏洞扫描技术 中国科技博览,2008.(21):49-50
[31]全国信息安全标准化技术委员会,GB/T 18336信息技术安全技术信息技术安全性评估准则北京:中国标准出版社,2001
[32]朱方洲 基于BS7799的信息系统安全风险评估研究[D]合肥:合肥工业大学,2007
[33]科飞管理咨询公司 BS 7799和IS0/IEC 17799信息安全管理体系及其认证认可相关知识问答北京:中国标准出版社,2003.9
[34]朱海林IT服务管理、控制与流程北京:机械工业出版社,2006.8
[35]汪立东 操作系统安全评估与审计增强:[博士学位论文]哈尔滨:哈尔滨工业大学,2002
[36]秦志光,张凤荔 计算机病毒原理与防范 北京:人民邮电出版社,2007.8
[37]钱雪忠 数据库原理及应用(第2版) 北京:北京邮电大学出版社,2007.8
[38]窦玉杰 网络服务器配置大全 北京:科学出版社,2006.5
[39]文洋 网管员使用大全 北京:电子工业出版社,2008.6
[40](美)麦肯兰勃(McNab,C.)著,王景新译Network Security Assessment,北京:中国电力出版社,2005.12
[41]刘洪发,唐洪 网络存储及灾难恢复技术[M]电子工业出版社,2008
[42]陈纪元 浅议数据备份的策略和方法[J]福建电脑,2007(10):63-64
[43]全国信息安全标准化技术委员会,GB/T 20988-2007信息安全技术信息系统灾难恢复规范北京:中国标准出版社,2007.9
[44]Kayashima M,Nagai Y,Terada[M].Network Security for the Broadband Era[J].Hitachi Review,2002,51(2):70-73
[45]李剑 信息安全培训教程 北京:北京邮电大学出版社,2008.3