摘要
通过对FDCC在美国成功的案例与现有信息系统等级保护和风险评估的测评指标分析,建立广东电网公司的安全配置检查规范模型。并基于该模型,借鉴SCAP协议的设计思路设计了各种类型安全配置检查枚举库。给出安全配置测评自动化工具的系统架构、模块组成和界面设计,工具的成功研制对提升信息系统等级保护测评结果的科学性、准确性都起到了非常大的促进作用,同时加快了测评的进度,提升了工作效率。
Through analysing the successful cases of FDCC in US and the measurement and evaluation indices of existing classified protection and risk assessments of information system, we build a specification model of security configuration inspection for Guangdong Power Grid Corporation. Based on this model and learning from the design idea of SCAP protocol, we design the enumeration library for various security configuration inspections. The architecture, module components and user interface design of the automation toolkit of security configuration measurement and evaluation are given as well. The successful research and development of the toolkit play a significant role in promoting the enhancement of the scientific property and accuracy of the measurement and evaluation results of classified protection of information system, at the same time, it also speeds up the progress of the measurement and evaluation as well as improves the working efficiency.
出处
《计算机应用与软件》
CSCD
北大核心
2014年第7期311-315,共5页
Computer Applications and Software
基金
国家自然科学基金项目(X2jsB6110010
X2jsB6100260
X2jsB55101680)
广州市科技计划项目(X2RJB2110140)
中央高校项目(X2RJD2116860)
国家大学生创新性实验计划项目(G101056137)
关键词
等级保护测评
安全配置
核查工具
联邦桌面核心配置计划
Classified protection measurement and evaluation
Security configuration
Inspection toolkit
Federal desktop core configuration (FDCC) plan