信息安全管理机制设计

Design on Information Security Management Mechanism

如何抑制攻击者对系统的攻击,是从根本上消除信息安全风险发生的关键。由于攻击者和防御者的效用函数不同,单独依靠技术手段并不能完全有效地控制和实现信息安全。而攻击者和防御者之间的风险控制问题其实就是将防御者作为委托人、攻击者作为代理人的委托代理问题,所以必须根据防御者具体的防御措施设计相应的防御机制,使攻击者在此机制下放弃或无法进行正常的进攻计划,从而达到从根本上消除信息安全风险发生的目的。

How to suppress the attacker＇s attack on the system is the key to fundamentally eliminate the risk of information security. Due to the different utility functions of the attacker and the defender, the technical means alone could not effectively control and realize the information security. The risk-control problem of between the attacker and the defender is actually the defender as the principal, the attacker as the agent of principal-agent problem. Therefore, the defense mechanism must be designed in accordance with the defenders＇ specific defense measures. Under this mechanism, the attacker would give up or fail to carry out a normal attack plan, thus to achieve the goal of eliminating infosec risk from the root.