面向ISO27001的本体建模及其应用--以企业恶意软件防护为例

ISO27001-Oriented Ontology Modeling and Its Application——Malware Prevention in Enterprises

信息安全标准已经逐渐成为企业整体信息防护的必要选择。ISO27000系列标准是国际上较为常用的一个安全标准框架。利用本体工具,对ISO27001安全标准的管理体系建设和系统实际要求两个方面进行本体建模。一方面梳理ISMS(企业信息安全管理体系)的逻辑结构,以便企业进行管理体系建立情况的自查,一方面利用本体构建系统中与标准要求相关的主客体及其关系,给出一种验证系统对标准的符合性方法。以恶意软件防护为例,构建相关文档体系结构和系统具体要求。通过实例验证,证明了所提方法能够较为客观地推理系统在恶意软件防护方面对安全标准的符合性,能降低人工评审的主观性,为标准的自动化评审作出创新性探索。

Infosec framwork increasingly becomes the necessary choice of an enterprise in its information protection on the whole. ISO/IEC 27001 is one of the most widely-used infosec standard frameworks. With ontology tool, the architecture and implementation of ISMS is ontologically modeled. The architecture could help the enterprise establish the document scheme of its ISMS while the implementation integrate the requirements made by the standard into a model system. Here the malware prevention is taken as an example for an automatic approach in measuring the compliance of a system with the standard framework, and this is an innovative exploration on the automatic verification process of ISO27001.