信息系统安全等级测评配置检查工具研究与实现  

ON INSPECTION TOOLKIT FOR MEASUREMENT AND EVALUATION CONFIGURATION OF INFORMATION SYSTEM SECURITY LEVEL AND ITS IMPLEMENTATION

作　　者：王甜[1] 夏斌伟 徐辉[1] 朱奕[1] 艾解清[1] 邹武斌 

机构地区：[1]广东电网公司信息中心,广东广州510600 [2]华南理工大学软件学院,广东广州510006

出　　处：《计算机应用与软件》2014年第7期311-315,共5页Computer Applications and Software

基　　金：国家自然科学基金项目(X2jsB6110010;X2jsB6100260;X2jsB55101680);广州市科技计划项目(X2RJB2110140);中央高校项目(X2RJD2116860);国家大学生创新性实验计划项目(G101056137)

摘　　要：通过对FDCC在美国成功的案例与现有信息系统等级保护和风险评估的测评指标分析,建立广东电网公司的安全配置检查规范模型。并基于该模型,借鉴SCAP协议的设计思路设计了各种类型安全配置检查枚举库。给出安全配置测评自动化工具的系统架构、模块组成和界面设计,工具的成功研制对提升信息系统等级保护测评结果的科学性、准确性都起到了非常大的促进作用,同时加快了测评的进度,提升了工作效率。Through analysing the successful cases of FDCC in US and the measurement and evaluation indices of existing classified protection and risk assessments of information system, we build a specification model of security configuration inspection for Guangdong Power Grid Corporation. Based on this model and learning from the design idea of SCAP protocol, we design the enumeration library for various security configuration inspections. The architecture, module components and user interface design of the automation toolkit of security configuration measurement and evaluation are given as well. The successful research and development of the toolkit play a significant role in promoting the enhancement of the scientific property and accuracy of the measurement and evaluation results of classified protection of information system, at the same time, it also speeds up the progress of the measurement and evaluation as well as improves the working efficiency.

关 键 词：等级保护测评 安全配置 核查工具 联邦桌面核心配置计划 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]