基于信息安全管理体系的技术脆弱性管理探讨

Discussion on technical vulnerability management based on information security management system

脆弱性是可能被一个或多个威胁利用的资产或控制的弱点。脆弱性识别是组织实施风险评估活动中最重要的一个环节,可从管理和技术两个方面进行识别。探讨了技术方面脆弱性的管理和软件安装限制两方面的最佳实践。提供一个关于技术方面脆弱性的实际审核案例,描述了主要的审核发现、沟通过程、受审核组织主要的改进方法等。

Vulnerability is a weakness of an asset or control that can be exploited by one or more threats.Vulnerability identification is the most important activity of the organization′s risk assessment,and it can be identified from both manager and technical aspects.This paper explores the best practices for management of technical vulnerabilities and restrictions on software installation,provides a practical audit case of technical vulnerability,describes the main audit findings and communication process and the main improvement methods of the audited organization,etc.