电网企业信息安全防护体系建设

Grid Enterprise Information Security System

结合电网企业实际情况,探讨了企业信息安全防护体系的建设。从全过程管理和全方位防护两方面入手,构建了信息安全防护体系框架。全过程管理包括规划设计、开发测试、实施上线、运行维护、系统使用和废弃下线6个管理环节;全方位防护覆盖了物理、边界、网络、主机、终端、应用和数据7个方面的安全防护。通过防护体系的构建,能有效解决由于系统信息系统规模扩大而带来的系统安全性维护问题。

This article focuses on the enterprise information security system construction based on the current situation of power grid corporations. An information security system framework covering whole process management and all-round protection is built. The whole process management involves the following six parts： planning and design,development and testing,implementation and go-live,support and maintenance,system operation,and system retirement. The all-round protection covers physical protection,boundary protection,server protection,terminal protection,application protection,and data protection. This system can effectively cope with the security maintenance of ever larger information systems.